NAVAL 

POSTGRADUATE 

SCHOOL 

MONTEREY,  CALIEORNIA 


THESIS 


NPS  GOVERNMENT  PURCHASE  CARD  PROGRAM:  AN 
ANALYSIS  OF  INTERNAL  CONTROLS 

by 

Alana  M.  Tweed 
Mareh  2014 

Thesis  Advisor:  Juanita  M.  Rendon 

Co-Advisor:  Rene  G.  Rendon 


Approved  for  public  release;  distribution  is  unlimited 


THIS  PAGE  INTENTIONALLY  LEET  BLANK 


REPORT  DOCUMENTATION  PAGE 


Form  Approved  OMB  No.  0704-0188 

Public  reporting  burden  for  this  collection  of  information  is  estimated  to  average  1  hour  per  response,  including  the  time  for  reviewing  instruction, 
searching  existing  data  sources,  gathering  and  maintaining  the  data  needed,  and  completing  and  reviewing  the  collection  of  information.  Send 
comments  regarding  this  burden  estimate  or  any  other  aspect  of  this  collection  of  information,  including  suggestions  for  reducing  this  burden,  to 
Washington  headquarters  Services,  Directorate  for  Information  Operations  and  Reports,  1215  Jefferson  Davis  Highway,  Suite  1204,  Arlington,  VA 
22202-4302,  and  to  the  Office  of  Management  and  Budget,  Paperwork  Reduction  Project  (0704-0188)  Washington  DC  20503. 

I.  AGENCY  USE  ONLY  (Leave  blank)  2.  REPORT  DATE  3.  REPORT  TYPE  AND  DATES  COVERED 

March  2014  Master’s  Thesis 

4.  TITLE  AND  SUBTITLE  5.  LENDING  NUMBERS 

NPS  GOVERNMENT  PURCHASE  CARD  PROGRAM:  AN  ANALYSIS  OF 
INTERNAL  CONTROLS _ 

6.  AUTHOR(S) 

7.  PEREORMING  ORGANIZATION  NAME(S)  AND  ADDRESS(ES)  8.  PEREORMING  ORGANIZATION 

Naval  Postgraduate  School  REPORT  NUMBER 

Monterey,  CA  93943-5000 

9.  SPONSORING  /MONITORING  AGENCY  NAME(S)  AND  ADDRESS(ES)  10.  SPONSORING/MONITORING 
N/A  AGENCY  REPORT  NUMBER 

II.  SUPPLEMENTARY  NOTES  The  views  expressed  in  this  thesis  are  those  of  the  author  and  do  not  reflect  the  official  policy 

or  position  of  the  Department  of  Defense  or  the  U.S.  Government.  IRB  Protocol  number _ NPS.20 14.00 17-IR-EP7-A _ . 

1 2a.  DISTRIBUTION  /  AVAll  ABll TTY  STATEMENT  12b.  DISTRIBUTION  CODE 

Approved  for  public  release;  distribution  is  unlimited _ 

13.  ABSTRACT  (maximum  200  words) 

The  purpose  of  this  research  is  to  determine  whether  there  are  differences  in  perceptions  between  approving  officials 
(AOs)  and  cardholders  (CHs)  regarding  internal  controls  within  the  Government  Purchase  Card  Program  (GPCP)  at 
the  Naval  Postgraduate  School  (NPS).  A  main  component  of  the  research  is  a  voluntary  and  anonymous  online  survey 
deployed  to  the  AOs  and  CHs  at  NPS.  Results  from  the  analysis  of  the  survey  data  can  be  used  to  identify  areas  of 
improvement  within  the  GPCP. 

Based  on  the  data  analysis,  there  were  eight  significant  differences  in  perceptions  of  internal  controls  between  AOs 
and  CHs.  They  were  identified  in  three  of  the  five  internal  control  components:  risk  assessment,  information  and 
communication,  and  monitoring  activities.  The  data  analysis  revealed  that  AOs  generally  responded  more  positively 
than  CHs,  implying  that  AOs  may  perceive  the  strength  of  the  GPCP’s  internal  controls  to  be  stronger  than  the  CHs 
perceive  them.  In  addition,  there  were  survey  items  to  which  both  AO  and  CH  responded  strongly,  which  included 
such  things  as  password  protection,  separation  of  duties,  and  adequate  fraud  education.  Both  strong  and  weak  internal 
controls  have  implications  on  auditability.  The  analysis  identified  potential  implications  of  internal  controls,  or  lack 
thereof,  on  auditability  within  the  GPCP  at  NPS. 

14.  SUBJECT  TERMS  P-Card,  purchase  card,  commercial  card,  government  purchase  card  program,  15.  NUMBER  OE 

auditability,  audit  readiness,  internal  controls,  COSO  PAGES 

_ 99 _ 

16.  PRICE  CODE 


17.  SECURITY 

18.  SECURITY 

19.  SECURITY 

20.  LIMITATION  OE 

CLASSIEICATION  OE 

CLASSIEICATION  OE  THIS 

CLASSIEICATION  OE 

ABSTRACT 

REPORT 

PAGE 

ABSTRACT 

Unclassified 

Unclassified 

Unclassified 

UU 

NSN  7540-01-280-5500  Standard  Form  298  (Rev.  2-89) 

Prescribed  by  ANSI  Std.  239-18 


1 


THIS  PAGE  INTENTIONALLY  LEET  BLANK 


11 


Approved  for  public  release;  distribution  is  unlimited 


NPS  GOVERNMENT  PURCHASE  CARD  PROGRAM:  AN  ANALYSIS  OF 

INTERNAL  CONTROLS 


Alana  M.  Tweed 
Civilian,  Department  of  the  Navy 
B.S.,  California  State  University  Monterey  Bay,  2010 


Submitted  in  partial  fulfillment  of  the 
requirements  for  the  degree  of 


MASTER  OF  BUSINESS  ADMINISTRATION 

from  the 


NAVAL  POSTGRADUATE  SCHOOL 
March  2014 


Author:  Alana  M.  Tweed 


Approved  by:  Juanita  M.  Rendon,  Ph.D. 

Thesis  Advisor 


Rene  G.  Rendon,  Ph.D. 
Co-Advisor 


William  Gates,  Ph.D. 

Dean,  Graduate  Sehool  of  Business  and  Publie  Poliey 


THIS  PAGE  INTENTIONALLY  LEET  BLANK 


IV 


ABSTRACT 


The  purpose  of  this  researeh  is  to  determine  whether  there  are  differenees  in  pereeptions 
between  approving  offieials  (AOs)  and  eardholders  (CHs)  regarding  internal  eontrols 
within  the  Government  Purehase  Card  Program  (GPCP)  at  the  Naval  Postgraduate  Sehool 
(NPS).  A  main  eomponent  of  the  researeh  is  a  voluntary  and  anonymous  online  survey 
deployed  to  the  AOs  and  CHs  at  NPS.  Results  from  the  analysis  of  the  survey  data  ean  be 
used  to  identify  areas  of  improvement  within  the  GPCP. 

Based  on  the  data  analysis,  there  were  eight  significant  differences  in  perceptions 
of  internal  controls  between  AOs  and  CHs.  They  were  identified  in  three  of  the  five 
internal  control  components:  risk  assessment,  information  and  communication,  and 
monitoring  activities.  The  data  analysis  revealed  that  AOs  generally  responded  more 
positively  than  CHs,  implying  that  AOs  may  perceive  the  strength  of  the  GPCP’s  internal 
controls  to  be  stronger  than  the  CHs  perceive  them.  In  addition,  there  were  survey  items 
to  which  both  AO  and  CH  responded  strongly,  which  included  such  things  as  password 
protection,  separation  of  duties,  and  adequate  fraud  education.  Both  strong  and  weak 
internal  controls  have  implications  on  auditability.  The  analysis  identified  potential 
implications  of  internal  controls,  or  lack  thereof,  on  auditability  within  the  GPCP  at  NPS. 
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I.  INTRODUCTION 


In  this  chapter,  the  baekground  and  purpose  of  this  researeh  is  presented,  and  the 
research  questions  are  addressed.  The  benefits  and  limitations,  in  addition  to  the 
importanee  of  this  researeh,  are  also  diseussed.  Finally,  the  methodology  is  briefly 
outlined,  and  the  scope  and  organization  of  the  research  are  presented. 

A,  BACKGROUND 

The  Department  of  Defense  (DOD)  and  the  Department  of  the  Navy  (DON) 
purehase  eard  programs  proeess  hundreds  of  thousands  of  transaetions  aecounting  for 
billions  of  dollars  annually.  In  2013,  the  federal  government’s  300,900  eardholders  (CHs) 
spent  $16.5  billion  on  18.9  million  transaetions  (GSA,  n.d.-e).  The  Government  Purehase 
Card  Program  (GPCP)  was  developed  as  a  tool  to  support  streamlining  initiatives  and 
was  intended  to  have  eost  savings  applieations  in  the  federal  government,  the  DOD, 
DON,  and  the  Naval  Postgraduate  Sehool  (NPS).  The  purchase  eard  is  used  in  many 
organizations  to  streamline  the  proeurement  proeess. 

Following  the  Executive  Order  12,931  (1982)  to  reduee  eosts  and  the  sueeessful 
pilot  phase  for  a  purehase  eard  program  in  1986,  the  federal  government  began  the  use  of 
a  government-wide  purchase  card  program  in  1989.  While  the  program  was  somewhat 
sueeessful,  due  to  the  weak  internal  eontrols  and  misuse  over  time,  additional  legislative 
aetions  were  put  in  plaee,  and  the  program  evolved  over  the  years.  In  1998,  the  General 
Serviees  Administration  (GSA)  SmartPay  Program  was  established  “to  serve  as  the 
premiere  eharge  eard  program  for  the  United  States  federal  government,  serving  more 
than  350  federal  ageneies  and  organizations”  (GSA,  2012).  In  2008,  the  federal 
government  spent  $30.6  billion  on  the  eommereial  eard,  whieh  ineludes  the  travel,  fleet, 
and  purehase  eards,  and  65%  of  that  was  spent  on  the  purchase  eard  alone  (Palmer, 
Gupta,  &  Dawson,  2010). 

The  GPCP  direetives  provide  very  speeific  rules,  regulations,  and  responsibilities 
for  all  key  personnel,  ineluding  approving  offieials  (AOs)  and  CHs,  in  order  to  maintain 
proper  training,  follow  eapable  proeesses,  and  implement  effeetive  internal  eontrols 
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(Rendon  &  Rendon,  2014).  The  DOD  is  tasked  with  being  auditable  by  2017;  therefore, 
the  program’s  speeifie  requirements  are  crucial  in  the  current  fiscal  environment.  Recent 
requirements  for  strong  internal  controls  and  the  Managers’  Internal  Control  Program 
(MICP)  need  to  be  implemented  to  ensure  organizations  are  in  compliance  with  internal 
control  directives  and  policies. 

The  GPCP  at  NPS  provides  a  “fast  and  convenient  method  to  pay  for  all 
requirements  under  the  micro  purchase-threshold”  (NPS,  2012,  p.  1)  of  $3,000  for 
civilian  and  military  personnel.  In  fiscal  year  (FY)  2012,  the  NPS  GPCP  processed 
approximately  21,000  transactions  that  accounted  for  approximately  $24  million 
(M.  Morales,  personal  communication,  July  24,  2013).  Although  the  GPCP  may  be 
convenient  and  realize  costs  savings,  an  analysis  of  the  perceived  internal  controls  and 
implications  to  auditability  is  warranted  to  ensure  compliance  with  established  internal 
control  policies  and  procedures. 

B,  PURPOSE  OF  RESEARCH 

The  purpose  of  this  research  is  to  determine  whether  there  are  differences  in 
perceptions  between  AOs  and  CHs  regarding  internal  controls  within  the  GPCP  at  NPS. 
A  main  component  of  the  research  is  a  voluntary  and  anonymous  online  survey  deployed 
to  the  AOs  and  CHs  at  NPS.  Results  from  the  analysis  of  the  survey  data  can  be  used  to 
identify  areas  of  improvement  within  the  GPCP.  This  research  also  potentially  identifies 
any  implications  of  the  perceived  differences  of  internal  controls  on  the  auditability  of  the 
GPCP  at  NPS. 

C.  RESEARCH  QUESTIONS 

The  research  questions  for  this  research  are  as  follows: 

•  What  are  the  differences  in  perceptions  of  internal  controls  between  the 
approving  officials  and  cardholders  in  the  Government  Purchase  Card 
Program  at  the  Naval  Postgraduate  School? 

•  What  are  the  implications  to  auditability  from  the  differences  in 
perceptions  of  internal  control  between  approving  officials  and 
cardholders  within  the  Government  Purchase  Card  Program  at  the  Naval 
Postgraduate  School? 
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D,  BENEFITS  AND  LIMITATIONS 

This  research  benefits  the  DON,  and  more  specifically,  NFS,  by  analyzing  the 
AOs’  and  CHs’  perceptions  of  the  internal  controls  within  the  GPCP  at  NFS.  The  results 
of  the  analysis  are  used  to  identify  recommendations  to  strengthen  the  internal  controls 
within  the  GPCP  at  NFS.  In  addition,  this  research  potentially  identifies  the  impact  that 
those  differences  in  perceptions  of  internal  controls  have  on  the  auditability  of  the  GPCP 
at  NFS. 

The  limitations  of  this  research  include  the  limited  number  of  participants  who 
complete  the  voluntary  anonymous  online  survey.  Although  NFS  allowed  access  to  all  of 
its  AOs  and  CHs,  the  survey  was  voluntary,  so  not  all  potential  participants  chose  to 
participate.  Another  possible  limitation  is  the  survey  instrument  itself  It  was  a 
combination  of  surveys  used  by  other  researchers,  but  it  may  have  been  limited  in  the 
type  of  questions  it  asked  with  regard  to  the  GPCP. 

E,  IMPORTANCE  OF  RESEARCH 

The  importance  of  this  research  is  that  the  GPCP  is  a  government-wide  program 
responsible  for  processing  hundreds  of  thousands  of  transactions  and  accounting  for 
billions  of  dollars  a  year.  To  ensure  the  program  is  managed  in  accordance  with  policy 
and  regulations,  it  is  imperative  to  understand  the  internal  controls  within  the  GPCP.  This 
research  assesses  the  perceptions  of  internal  controls  by  both  AOs  and  CHs  and  makes 
recommendations  to  the  GPCP  at  NFS. 

F,  METHODOLOGY 

This  research  includes  a  literature  review,  the  development  and  distribution  of  the 
online  survey,  and  an  analysis  of  the  responses  to  the  survey.  The  literature  review 
includes  a  review  of  scholarly  peer-reviewed  articles,  which  are  related  to  internal 
controls  and  purchase  cards.  Government  Accountability  Office  (GAO)  reports, 
government  policies,  and  DOD  and  DON  instructions. 

The  online  survey  was  developed  using  a  previously  validated  internal  control 
survey  as  well  as  other  sources.  The  survey  consisted  of  demographic  survey  items  and 


3 


Likert-based  survey  items  regarding  internal  controls.  The  survey  was  deployed  to  AOs 
and  CHs  at  NFS  using  the  web-based  survey  software,  LimeSurvey.  Once  the  survey  was 
deployed,  it  was  available  for  three  weeks. 

After  the  survey  period  was  over,  the  data  collected  from  the  survey  responses 
was  reviewed  and  analyzed  as  it  related  to  the  five  internal  control  components. 
Descriptive  statistics  was  used  in  the  data  analysis  using  SPSS. 

G.  SCOPE  AND  ORGANIZATION 

This  research  paper  contains  six  chapters,  including  the  introduction.  Chapter  II 
includes  a  literature  review  covering  the  industry  purchasing  card  and  the  GPCP  and  its 
application  to  the  federal  government,  the  DOD,  and  the  DON.  The  chapter  also 
discusses  internal  controls  and  auditability,  including  supporting  legislation.  Chapter  III 
discusses  NFS’s  use  of  the  GPCP,  including  the  mission,  the  Contracting  and  Logistics 
Management  organization,  and  the  GPCP  organizational  structure.  Chapter  IV  presents 
the  methodology  used  to  conduct  the  research  and  to  develop  and  deploy  the  online 
survey.  Chapter  V  analyzes  the  survey  results,  discusses  the  findings  and  the  implications 
of  the  findings,  and  offers  recommendations  based  on  the  findings.  Chapter  VI 
summarizes  the  research  and  provides  conclusions  and  areas  for  further  research.  The 
following  section  provides  a  summary  of  this  chapter. 

H.  SUMMARY 

This  chapter  presented  the  background  and  purpose  of  this  research  and  addressed 
the  research  questions.  The  benefits  and  limitations,  in  addition  to  the  importance  of  this 
research  were  also  discussed.  Finally,  the  methodology  was  briefly  outlined,  and  the 
scope  and  organization  of  the  research  were  presented.  The  next  chapter  provides  a 
literature  review  of  the  purchase  card  program  and  internal  controls. 
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II.  LITERATURE  REVIEW 


A,  INTRODUCTION 

This  chapter  presents  the  evolving  role  of  the  purchasing  function  and  the  industry 
purehase  card  program.  The  Government  Purchase  Card  Program  (GPCP)  and  its 
applieation  in  the  federal  government,  the  Department  of  Defense  (DOD),  and  the 
Department  of  the  Navy  (DON)  are  then  discussed.  The  Naval  Postgraduate  School 
(NPS)  GPCP  will  be  discussed  in  Chapter  III.  In  addition,  corporate  governance  is 
addressed,  which  includes  auditability,  the  Sarbanes-Oxley  Aet  of  2002  (SOX),  and 
Committee  of  Sponsoring  Organizations  of  the  Treadway  Commission  (COSO). 
Furthermore,  the  integrated  internal  eontrol  eomponents  are  discussed  as  well  as  internal 
eontrols  in  the  federal  government.  The  next  section  discusses  the  evolving  role  of  the 
purchasing  function. 

B,  THE  EVOLVING  ROLE  OF  THE  PURCHASING  FUNCTION 

In  most  organizations,  purchasing  is  a  basic  function  used  to  aequire  goods  and 
services  to  aceomplish  the  goals  of  the  organization.  Purehasing  also  eontributes  to  the 
success  of  the  organization  and,  in  some  cases,  has  more  impaet  on  the  bottom  line  than 
other  business  functions  (Burt,  Dobler,  &  Starling,  2003).  Throughout  the  history  of 
purchasing,  many  changes  have  signifieantly  shifted  supply  managers’  perspeetives  of 
the  purchasing  department  and  its  importance  to  the  organization. 

Purchasing  has  long  been  eonsidered  a  subordinate  function  to  research  and 
development,  fmanee,  marketing,  and  operations;  however,  it  has  developed  into  a 
strategie  management  function,  with  high  value  placed  upon  cost  savings  and  increased 
efficieney  and  effectiveness  (Burt  et  ah,  2003).  In  the  1960s  and  1970s,  inventory  was 
managed  with  a  manual  system,  and  the  focus  at  the  time  were  purchase  price  and 
preventing  produetion  line  shutdowns.  In  the  late  1970s,  computers  began  to  help  with 
inventory  management  at  the  same  time  that  automation  in  the  production  process  was 
increasing,  which  drove  unit  production  costs  down.  In  the  1980s,  managers  began  to 
manage  their  inventories  more  carefully  and  started  to  utilize  eomputer-generated 
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materials  requirement  plans,  whieh  in  turn  redueed  inventory  levels,  decreased  costs,  and 
increased  efficiency.  Finally,  in  the  late  1980s,  managers  included  supply  management  in 
their  organizations’  strategic  business  plans  and  increased  the  focus  on  purchasing 
departments  (Burt  et  ah,  2003).  The  historical  focus  was  purchase  price  as  well  as  supply 
continuity;  however,  today  the  focus  is  on  value-adding  benefits  such  as  quality,  cost, 
time,  technology,  and  supply  continuity. 

Major  developments  in  the  purchasing  function  involve  the  area  of  supply 
management,  which  includes  cross-functional  teams,  supply  chains  and  networks,  supply 
alliances,  strategic  sourcing,  and  e-procurement.  Cross-functional  teams  combine 
members  of  different  functional  areas  to  find  solutions  to  problems,  demonstrating  team 
behavior  and  developing  leadership  skills  (Burt  et  ah,  2003).  Cross-functional  team 
participation  in  the  development  of  supply  chains  and  networks  identifies  desirable 
suppliers  by  identifying  which  value-added  activities  are  most  important  to  the 
organization’s  strategic  supply  plan  (Burt  et  ah,  2003).  Once  the  supply  chains  and 
networks  are  identified,  supply  alliances  are  fostered  through  mutually  beneficial 
relationships  (Burt  et  ah,  2003).  Furthermore,  supply  management  personnel  must  decide 
the  appropriate  relationship  with  each  supplier  in  order  to  accomplish  organizational 
goals  and  objectives. 

Management  has  also  shifted  its  thinking  about  using  sources  strategically. 
Strategic  sourcing  is  an  organized  approach  that  utilizes  the  supply  base  to  achieve  the 
organization’s  objectives.  Strategic  sourcing  also  integrates  suppliers  into  long-term 
plans  and  improves  the  organization’s  value.  Lastly,  Burt  et  al.  (2003)  stated  that 
“e-procurement  is  one  of  the  most  exciting  developments  in  supply  management”  (p.  33). 
Technologies  that  enhance  business  operations  have  emerged.  Buyers  are  no  longer 
required  to  process  paperwork  since  they  can  now  place  orders  over  the  Internet  directly 
to  suppliers.  This  is  a  major  development  for  the  purchasing  department,  and  the  use  of 
technology  supports  streamlining  and  strategic  sourcing  initiatives. 

Leenders  and  Fearon  (1997)  discussed  the  advantages  of  both  a  centralized  and 

decentralized  purchasing  department.  The  advantages  of  centralization  include  a 

standardized  purchasing  process  and  decreased  administrative  duplication.  Therefore,  that 
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results  in  an  increase  in  the  number  of  contracts  for  large  quantities  of  items  for  the 
organization.  However,  decentralizing  the  purchasing  authority  allows  independent 
department  managers  to  handle  their  own  purchasing  since  they  are  more  familiar  with 
the  department’s  specific  requirements  (Leenders  &  Fearon,  1997).  Decentralized 
authority  also  gives  the  purchaser  more  flexibility,  which  necessitates  an  additional 
emphasis  on  internal  controls  to  help  ensure  that  purchasers  are  in  compliance  with 
established  purchasing  policies  and  procedures.  While  these  developments  are  helping 
streamline  purchasing  initiatives,  there  appears  to  be  a  small-order  problem,  which  is 
discussed  in  the  next  section. 

1,  Small-Order  Problem 

Leenders  and  Fearon  (1997)  and  Burt,  Petcavage,  and  Pinkerton  (2010) 
discovered  that  small  orders  are  a  problem  in  most  organizations.  Burt  et  al.  (2010)  gave 
an  example  of  a  typical  company  in  which  a  large  percentage  (sometimes  as  high  as  80%) 
of  its  purchases  involved  a  purchase  of  less  than  $250.  However,  these  purchases 
represented  a  small  percentage  (close  to  10%)  of  the  organization’s  total  annual  spending. 
With  the  current  purchasing  department  organization,  the  transaction  cost  to  purchase  a 
small-value  item  is  likely  more  than  the  item  cost  itself  (Monczka,  Hanfield,  Giunipero, 
and  Patterson,  2011).  Thus,  the  organization  is  spending  more  time  and  money  on  small 
purchase  transactions.  Leenders  and  Fearon  (1997)  offered  approaches  to  simplify  or 
automate  the  purchasing  process,  reduce  cycle  time,  lower  costs,  and  increase  the  buyers’ 
time  spent  on  high-value  orders.  One  solution  to  the  small-order  problem  was  the  use  of 
purchase  cards  distributed  to  internal  customers  to  order  directly  from  suppliers,  which 
was  one  of  the  new  streamline  initiatives  supported  by  e-procurement.  The  process  of 
moving  the  small-value  purchasing  activity  to  the  department’s  cardholder  reduces  cycle 
time  and  transaction  costs  (Burt  et  ah,  2003).  In  addition,  the  transition  of  small-value 
purchasing  allows  the  purchasing  agents  to  concentrate  their  time  on  higher  value 
purchases  (Leenders  &  Fearon,  1997).  Therefore,  a  tool  most  organizations  considered 
central  to  improving  the  purchasing  process  was  the  purchase  card  (Monczka,  et  ah, 
2011). 
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The  use  of  purchase  cards  and  the  implementation  of  the  purchase  card  program  is 
a  solution  to  the  small-order  problem.  The  purchase  card  is  used  to  pay  for  items  of  small 
value,  including  maintenance,  repair,  and  operating  (MRO)  items.  MRO  items  do  not 
become  part  of  an  organization’s  product,  but  they  are  essential  for  operating  the 
business.  This  includes  “spare  machine  parts,  office  and  computer  supplies,  and  cleaning 
supplies”  (Monczka  et  ah,  2011,  p.  74).  Some  organizations  set  a  purchase  threshold  limit 
that  cardholders  cannot  exceed  when  purchasing  MRO  items.  The  National  Association 
of  Purchasing  Card  Professionals  (NAPCP,  2013a)  website  states  that  “P-Cards  were 
introduced  as,  and  continue  to  be,  corporate  (organization)  liability/central  pay  payment 
vehicles  for  which  payment  in  full  must  be  made  by  the  end  user  organization  to  the  card 
issuer  at  least  monthly”  (para.  3).  This  attribute  of  a  P-Card  remains  the  primary 
distinction  from  consumer  and  small  business  credit  cards. 

Other  commercial  card  products  include  the  travel  card,  corporate  card,  fleet  card, 
one  card,  prepaid  card,  declining  balance  card,  and  business  card  (NAPCP,  2013d).  They 
are  all  intended  to  address  different  types  of  purchases;  however,  this  research  focuses  on 
the  P-Card,  as  it  is  most  similar  to  the  purchase  card  used  in  the  GPCP. 

This  section  discussed  the  evolving  role  of  the  purchasing  function  and  the  small- 
order  problem.  In  addition,  it  discussed  how  the  purchase  card  is  a  solution  to  that 
problem.  The  next  section  discusses  the  use  of  the  P-Card  in  industry. 

C.  INDUSTRY  P-CARD  PROGRAM 

The  industry  purchase  card,  also  known  as  a  P-Card,  is  a  credit  card  that  allows 
end-user  organizations  to  utilize  the  existing  credit  card  infrastructure  to  make  business- 
to-business  payments  for  a  variety  of  business  expenses,  such  as  goods  and  services 
(NAPCP,  2013c,  para.  1).  After  the  purchase  card  was  developed  and  introduced  to  the 
U.S.  federal  government  for  the  General  Services  Administration  (GSA),  the  P-Card  was 
introduced  to  industry  in  the  1980s.  The  P-Card  is  most  commonly  used  in  the  corporate, 
education,  and  government  sectors.  The  P-Card  is  similar  to  a  consumer  credit  card; 
however,  the  end-user  organization  using  a  P-Card  must  pay  the  card-issuing  bank 
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the  full  balance  on  a  monthly  basis,  instead  of  monthly  minimum  payments  until  the 
credit  card  bill  is  paid  off.  For  low-value  purchases,  which  are  considered  less  than 
$2,500,  respondents  of  a  2010  survey  reported  that  purchase  cards  now  handle  44%  of  all 
transactions  (Palmer  &  Gupta,  2010).  In  2009,  large  market  industry  organizations  had 
449  P-Cards  and  made  approximately  8.6  monthly  transactions  per  card,  and  spent  a 
monthly  average  of  $1.03  billion  (Palmer  &  Gupta,  2010).  Large  market  statistics  include 
companies  with  annual  sales  of  $500  million  to  $2  billion  (Palmer  &  Gupta,  2010). 

The  P-Card  program  in  industry  was  developed  to  streamline  payment  and  reduce 
costs  for  purchasing  small-value  items,  which  helps  solve  the  small-order  problem  that 
was  previously  discussed.  The  P-Card  program  is  a  valuable  asset  to  most  organizations. 
The  P-Card  program  involves  the  use  of  a  credit  card  that  allows  an  organization’s 
employees,  also  known  as  a  cardholder,  to  make  small-value  purchases  in  a  timely  and 
efficient  manner.  The  P-Card  program  also  expedites  supplier  payments  and  reduces 
or  eliminates  the  paperwork  associated  with  a  paper  transaction  (Gupta  &  Palmer,  2008). 
P-Cards  have  proven  their  value  in  improving  efficiencies,  decreasing  processing  costs, 
and  decreasing  cycle  time  (Palmer  &  Gupta,  2010).  Transaction  costs  have  decreased  by 
76%,  and  cycle  time  was  reduced  by  72%  (Palmer  &  Gupta,  2010).  The  future  goals  of 
the  P-Card  include  such  things  as  increasing  convenience  and  reducing  transaction 
processing  (Palmer  &  Gupta,  2010). 

The  industry  P-Card  program  also  has  the  option  to  implement  internal  controls, 
including  single -purchase  spending  limits,  monthly  limits,  and  other  restrictions 
(NAPCP,  2013b).  Internal  controls  are  discussed  later  in  this  chapter,  and  other  sections 
discuss  the  application  of  a  purchase  card  program  in  multiple  settings,  to  include  the 
federal  government,  the  DOD,  and  the  DON.  The  next  section  provides  an  overview  of 
the  roles  and  responsibilities  within  an  industry  P-Card  program. 

1.  Roles  and  Responsibilities  within  an  Industry  P-Card  Program 

This  section  provides  an  overview  of  the  roles  and  responsibilities  of  the  entities 
involved  in  a  P-Card  program.  Those  roles  include  cardholders,  end-user  organizations, 
issuers,  merchant  acquirers,  networks,  and  processors. 
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Cardholders  are  responsible  for  making  purehases  and  payments  on  behalf  of  the 
end-user  organization.  Cardholders  are  expeeted  to  follow  the  end-user  organization’s 
speeifie  polieies  and  are  responsible  for  reviewing  and  approving  transaetions  at  least 
monthly  (NAPCP,  2013b).  End-user  organizations  reeeive  the  invoiees  from  eardholders’ 
P-Card  transaetions  and  are  responsible  for  paying  the  balanee  in  full  monthly.  The  end- 
user  organization  assumes  liability  for  payment  (NAPCP,  2013b).  Issuers  work  direetly 
with  the  end-user  organizations  to  issue  P-Cards  and  invoiee  P-Card  transaetions. 
Aeeording  to  NAPCP  (2013b),  issuers  are  often  finaneial  institutions,  and  they  work  with 
networks  and  proeessors  to  issue  eards,  authorize  transaetions,  and  provide  data. 

Aeeording  to  the  NAPCP  (2013b),  merehant  aequirers  “enroll  suppliers  in  the 
eard  aeeeptanee  proeess  and  implement  required  solutions  related  to  this  purpose.  In 
addition,  they  faeilitate  payment  flow,  ineluding  payment  to  suppliers,”  (para.  3). 
Networks  faeilitate  the  movement  of  transaetional  data  between  the  issuer  and  merehant 
aequirer  and  set  the  rules  pertaining  to  P-Card  aeeeptanee  by  suppliers  (NAPCP,  2013b, 
para.  4).  Examples  of  networks  inelude  Visa,  MasterCard,  and  Ameriean  Express. 
Proeessors  “provide  various  serviees  to  eard  issuers  and  merehant  aequirers,  whieh  may 
inelude  eard  produetion,  statement  printing,  authorization,  and  data  delivery”  (NAPCP, 
2013b,  para.  5). 

It  is  important  to  know  the  roles  and  responsibilities  previously  deseribed  to 
understand  the  interrelationships  between  eardholders,  end-user  organization,  issuers, 
merehant  aequirers,  networks,  and  proeessors.  Eaeh  partieipant  plays  a  signifieant  role  in 
the  sueeess  of  a  P-Card  program.  The  P-Card  proeess  and  the  relationship  between  all  of 
the  entities  involved  are  illustrated  in  Appendix  A.  This  seetion  diseussed  the  use  of  the 
P-Card  in  an  industry  P-Card  program  and  provided  an  overview  of  the  roles  and 
responsibilities  within  an  industry  P-Card  program.  Just  like  in  industry,  the  federal 
government  also  has  a  pure  base  eard  program.  The  next  seetion  will  review  the  GPCP. 
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D,  GOVERNMENT  PURCHASE  CARD  PROGRAM 

The  government’s  interest  in  purehase  eards  began  in  1982  as  a  procurement 
initiative  reform  (Gupta  &  Palmer,  2008).  After  the  successful  pilot  phase  in  1986,  the 
government  began  utilizing  the  purchase  card  program  in  1989  when  the  first 
government-wide  purchase  card  contract  was  awarded  by  the  GSA  to  the  Rocky 
Mountain  BankCard  System.  In  1993,  the  United  States’  Vice  President’s  National 
Performance  Review  further  streamlined  the  purchase  card  process  and  reduced  the 
red  tape  to  make  a  purchase  under  the  micro-threshold  of  $2,500.  In  October  1994,  the 
Federal  Acquisition  Streamlining  Act  (FASA)  of  1994  and  Executive  Order  12,931 
(1994)  were  established  to  further  promote  the  use  of  the  purchase  card.  In  2002,  when 
the  purchase  card  program  was  at  risk  due  to  General  Accounting  Office  (GAO,  2003) 
and  Inspectors  General  report  findings  of  misuse,  agencies  were  told  to  review  their 
internal  controls  associated  with  minimizing  risk  in  the  purchase  card  program  (Gupta  & 
Palmer,  2008).  In  2006,  the  micro-purchase  threshold  was  increased  from  the  previous 
$2,500  to  the  current  threshold  of  $3,000.  The  government  is  continuously  striving  to 
improve  the  various  aspects  of  the  GPCP,  including  internal  controls. 

Prior  to  the  use  of  purchase  cards,  the  government  used  the  traditional  paper- 
based  procurement  process,  such  as  purchase  orders,  to  place  orders;  however,  that 
offered  little  flexibility  and  no  accountability  or  oversight  nor  did  it  solve  the  small  order 
problem.  Thus,  one  of  the  major  benefits  of  using  purchase  cards  is  that  it  helped  solve 
the  small-order  problem.  Another  benefit  of  using  the  purchase  card  is  the  “ability  to 
streamline  transaction  processing,  increase  accountability,  and  provide  agencies  with  a 
more  efficient  and  effective  means  of  monitoring  large  numbers  of  transactions,  and 
identifying  fraud,  waste,  and  abuse  in  the  program”  (GSA,  n.d.-a).  The  Office  of 
Inspector  General  (OIG,  2014)  defines  fraud,  waste  and  abuse  on  its  website.  Fraud  is 
“a  type  of  illegal  act  involving  the  obtaining  of  something  of  value  through  willful 
misrepresentation.  Waste  relates  primarily  to  mismanagement,  inappropriate  actions,  and 
inadequate  oversight.  Abuse  involves  behavior  that  is  deficient  or  improper  as  well  as 
misuse  of  authority  or  position  for  financial  interests,”  (OIG,  2014,  paras.  2,  5,  6).  The 
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various  government  aetions  enabling  the  government-wide  purehase  eard  program  over 
the  years  are  shown  in  Table  1. 


Government  Aetions 

Year 

Exeeutive  Order  12352 

1982 

Pilot  Phase  of  a  Government  Commereial  Credit  Card 

1986 

Introduetion  of  Government-Wide  Purehase  Card  System 

1989 

National  Performanee  Review  (NPR)  Reeommendations 

1993 

Federal  Aequisition  Regulation  (FAR)  Interim  Rule 

1994 

Federal  Aequisition  Streamlining  Aet  (FAS A) 

1994 

Exeeutive  Order  12931 

1994 

Introduetion  of  SmartPay 

1998 

Offiee  of  Management  and  Budget  Memo 

2002 

Proposed  Eegislation 

2005 

Revised  0MB  Cireular  A- 1 23 

2006 

0MB  Cireular  A- 123,  Revised  Appendix  B 

2009 

Table  1 .  Government  Aetions  Related  to  the  Purehase  Card  Program 
(after  Gupta  &  Palmer,  2008,  p.  177) 


The  GPCP  implements  streamlining  initiatives  and  offers  a  solution  to  the  small- 
order  problem,  whieh  is  diseussed  later.  The  federal  government  applieation  of  the  GPCP 
is  diseussed  next. 

1.  Federal  Government  Application  of  the  Government  Purchase  Card 
Program 

The  GPCP,  now  known  as  the  GSA  SmartPay  Program,  partnered  with  national 
banks  to  provide  purehase  eards  to  over  52  federal  ageneies/departments  and  non- 
independently  reported  ageneies  throughout  the  U.S.  government  to  support  streamlined 
aequisition  initiatives.  The  GPCP  is  intended  to  “streamline  the  small  purehase  and  the 
payment  proeess,  minimize  paperwork,  eliminate  imprest  fund  transaetions,  and  generally 
simplify  the  administrative  effort  assoeiated  with  proeuring  goods  and  serviees  under 
the  miero-purehase  threshold”  (“Government  Purehase  Card  [GPC]  Program,”  2013, 
para.  1).  Aeeording  to  the  Federal  Aequisition  Regulation  (FAR)  2.101  (2014),  a  miero- 
purehase  is  an  aequisition  of  supplies  or  serviees  using  simplified  aequisition  proeedures. 
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where  the  total  amount  of  the  purchase  does  not  exceed  the  micro-purchase  threshold, 
which  is  currently  set  at  $3,000. 

The  following  sections  discuss  the  small-order  problem  and  the  use  of  the 
purchase  card  in  the  federal  government.  In  addition,  an  overview  of  the  roles  and 
responsibilities  and  the  training  requirements  are  discussed  regarding  the  federal 
government  GPCP. 

a.  Small-Order  Problem  as  Related  to  the  Federal  Government  Purchase 
Card  Program 

The  implementation  of  the  purchase  card  program  is  beneficial  to  the  government 
because  it  increases  savings  and  decreases  costs  and  transaction  times  associated  with 
small  orders.  Once  the  purchase  card  is  in  the  hands  of  customers,  they  can  streamline 
purchasing  and  eliminate  the  use  of  purchasing  agents,  which  helps  lower  the  transaction 
costs  of  items.  Involving  a  purchasing  agent  in  a  lower  value  purchase  would  likely 
outweigh  the  cost  of  the  item;  thereby,  emphasizing  the  value  of  the  purchase  card 
(Monczka  et  ah,  2011).  Palmer  et  al.  (2010)  determined  from  their  research  that,  “The 
best  estimate  of  government  cost  savings  from  driving  a  paper-based  approval  and 
payment  process  to  a  purchase  card  is  $69  per  transaction”  (p.  324).  The  government  will 
realize  more  cost  savings  as  more  transactions  are  being  paid  for  by  the  purchase  card 
(Palmer  et  ah,  2010).  Gupta  and  Palmer  (2008)  found  that  purchases  under  the  micro¬ 
purchase  threshold  accounted  for  only  2%  of  total  federal  government  spending,  but 
85%  of  all  procurement  transactions.  That  is  a  significant  majority  of  the  purchasing 
requirements.  This  finding  reinforced  the  fact  that  the  small-order  problem  is  prevalent  in 
the  federal  GPCP  and  illustrated  the  importance  of  the  purchase  card.  The  next  section 
discusses  the  use  of  the  purchase  card  in  the  federal  government  and  metrics  in  the 
current  fiscal  environment. 

b.  Purchase  Card  Use  in  the  Federal  Government 

The  federal  government  has  recognized  the  benefit  of  the  purchase  card  since  the 
initial  legislation  that  introduced  it  in  1982  (Palmer  et  ah,  2010).  Since  the  inception  of 
the  program,  the  pressure  to  utilize  the  purchase  card  increased,  enabling  the  program  to 
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grow,  until  recently.  Since  2000,  the  government  purchase  card  has  “accounted  for  65  to 
70  percent  of  commercial  card  spending”  (Palmer  et  ah,  2010,  p.  317).  The  federal 
government  uses  the  term  commercial  card  to  refer  to  the  travel,  fleet,  and  purchase 
cards.  For  example,  in  2008,  the  government  spent  $30.6  billion  on  the  commercial  card, 
$19.8  billion  of  which  was  spent  on  the  purchase  card  (Palmer  et  ah,  2010).  However, 
researchers  agreed  that  the  program’s  growth  has  slowed  due  to  maturation  and  is  now  on 
a  slow  decline  (Gupta  &  Palmer,  2008;  Palmer  et  ah,  2010).  That  is  not  surprising  due  to 
the  current  fiscal  environment. 

In  their  study  on  purchase  card  use.  Palmer  et  al.  (2010)  compared  the  number  of 
cards,  transactions,  and  total  spending  over  six  fiscal  years,  from  2008  to  2013.  The 
number  of  cardholders  was  close  to  357,000  in  2008  (Palmer  et  ah,  2010),  compared  to 
300,900  in  2013  (GSA,  n.d.-c).  This  decrease  in  cardholders  is  in  keeping  with  several 
government  reports  that  encourage  lowering  the  number  of  cardholders  to  gain  more 
control  over  the  program  and  reduce  fraud,  waste,  and  abuse  (GAO,  2008).  The  number 
of  transactions  has  been  in  a  steady  decline,  from  25.5  million  in  2008  (Palmer  et  ah, 
2010)  to  18.9  million  in  2013  (GSA,  n.d.-c).  It  appears  as  though  the  government  may  not 
be  utilizing  the  program  to  its  full  potential,  and  therefore,  may  not  be  realizing  the  total 
benefits.  In  addition,  the  total  purchase  card  spending  was  at  a  high  of  $19.8  billion  in 
2008  (Palmer  et  ah,  2010)  and  was  at  a  low  of  $16.5  billion  in  2013  (GSA,  n.d.-c).  This 
decrease  may  be  due  to  the  major  budget  cuts  in  the  federal  government.  The  purchase 
card  program  has  been  very  beneficial  to  the  government  by  moving  the  purchasing 
authority  to  the  customer,  reducing  transaction  time,  and  increasing  cost  savings.  The 
next  section  includes  a  discussion  of  the  roles  and  responsibilities  within  the  federal 
GPCP. 


c.  Roles  and  Responsibilities  within  the  Federal  Government  Purchase 
Card  Program 

The  participants  of  the  federal  GPCP  include  the  agency/organization  program 
coordinator  (A/OPC),  approving  official  (AO),  cardholder  (CH),  designated  billing  office 
(DBO),  merchant,  and  card-issuing  bank.  The  purchase  card  may  only  be  issued  to 
civilian  or  military  personnel,  so  contractors  cannot  participate  in  the  program.  The 
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A/OPC  is  responsible  for  managing  and  overseeing  the  eommand’s  GPCP,  establishing 
internal  guidelines,  establishing  and  maintaining  aeeounts,  and  assisting  eardholders.  The 
AO  is  the  first  point  of  eontaet  to  prevent  fraud,  waste,  and/or  abuse  of  the  purehase  eard. 
The  AO  supervises  the  CH  and  is  responsible  for  reviewing  and  approving  his  or  her 
purehases.  The  AO  should  also  resolve  any  questionable  pure  bases  and  report  any 
miseonduet.  The  CH  uses  the  government  purehase  eard  to  aequire  supplies  and  serviees 
within  the  CH’s  authority.  The  CH  is  responsible  for  using  the  eard  properly  and  ethieally 
and  following  all  rules  and  regulations  assoeiated  with  the  CH’s  delegated  purehase 
authority.  The  DBO  oversees  invoiee  proeessing  and  payment.  The  eard-issuing  bank  is 
responsible  for  issuing  purehase  eards,  proeessing  merehant  eharges  and  eredits,  and 
providing  monthly  AO  and  CH  aeeount  statements  (GSA,  n.d.-d).  The  government  has 
partnerships  with  Citibank,  JP  Morgan  Chase,  and  U.S.  Bank  (GSA,  n.d.-b),  and  these 
institutions  serve  as  the  issuing  banks  for  government  ageneies.  The  following  seetion 
diseusses  the  training  requirements  within  the  federal  GPCP. 

d.  Training  Requirements  within  the  Federal  Government  Purchase  Card 
Program 

The  Offiee  of  Management  and  Budget  (0MB,  2009)  Cireular  A-123,  Appendix 
B,  requires  eaeh  ageney  to  provide  training  to  CHs  and  eard  managers  (ineluding  A/OPCs 
and  AOs).  At  a  minimum,  the  General  Serviees  Administration  (GSA)  requires  online 
training  and  refresher  training  offered  by  the  Defense  Aequisition  University  (DAU). 
Credit  worthiness  assessments  used  to  be  mandated  for  new  CHs,  but  after  the  passing  of 
the  2006  Consolidated  Appropriations  Aet,  that  requirement  was  eliminated  (Defense 
Proeurement  and  Aequisition  Poliey  [DPAP],  2011;  Rendon,  2011).  The  GSA  SmartPay 
Program  offers  free  online  CH  training  to  all  program  partieipants.  The  program  requires 
partieipants  to  eomplete  training  prior  to  appointment  to  any  position  within  the  GPCP.  In 
addition,  refresher  training  is  required  onee  every  three  years  or  more  often  based  on 
ageney  requirements.  Finally,  ethies  training  is  also  required.  Program  partieipants  should 
remain  familiar  with  the  rules  and  regulations  governing  the  use  of  the  purehase  eard 
(GSA,  n.d-e).  AOs  should  also  familiarize  themselves  with  their  ageney’s  approval  and 
traeking  systems. 
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As  previously  mentioned,  the  GSA  SmartPay  eontract  provides  purchase  cards  to 
over  52  federal  agencies,  one  of  which  is  the  DOD.  The  DOD  application  of  the  GPCP  is 
discussed  in  the  next  section. 

2.  Department  of  Defense  Application  of  the  Government  Purchase 
Card  Program 

The  DOD  GPCP  currently  uses  Citibank  to  process  all  types  of  transactions, 
including  those  made  with  the  purchase,  travel,  and  fleet  card.  However,  the  DOD’s 
independent  agencies  also  use  U.S.  Bank  solely  for  purchase  card  transactions.  In 
FY2008,  the  DOD  GPCP  had  98,839  cardholders,  making  8.8  million  transactions 
totaling  $7.9  billion.  As  of  FY2013,  the  GSA  SmartPay  Program  reported  that  the 
DOD  purchase  card  program  had  approximately  92,647  cardholders  making  5.7  million 
transactions  valued  around  $4.9  billion.  (GSA,  n.d.-c)  The  DOD  GPCP  has  significantly 
downsized  in  the  last  five  years,  which  is  expected  in  the  current  fiscal  environment. 
However,  the  DOD  embraces  the  purchase  card  program  as  it  continually  seeks  methods 
for  cost  savings  and  increased  accountability.  The  next  section  discusses  the  DOD 
guidance  for  the  GPCP. 

a.  Department  of  Defense  Guidance  for  the  Government  Purchase  Card 
Program 

FAR  13.301  (2014)  and  Defense  Federal  Acquisition  Regulation  Supplement 
(DFARS)  213.270  (2014)  and  213.301  (2014)  outline  the  policy  for  using  the  GPCP. 
The  DOD  also  provides  guidance  for  its  components  to  help  establish  the  purchase 
card  program  and  implement  government-  and  DOD-mandated  controls,  rules,  and 
regulations.  The  DOD  Purchase  Card  Program  Management  Office  has  oversight  of  the 
DOD’s  GPCP  (Office  of  Financial  Management  [FMO],  n.  d.).  Each  component  may 
adopt  more  stringent  controls  if  necessary  or  desired,  but  the  rules  and  regulations  apply 
to  every  component  utilizing  the  GPCP.  The  process  of  establishing  a  purchase  card 
program  entails  determining  a  need,  requesting  authority,  establishing  internal  controls, 
and  establishing  training  programs  for  program  officials  (DPAP,  2011).  The  purpose  of 
the  purchase  card  is  to  add  value  to  the  business  processes  in  terms  of  lower  costs  or 
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increased  productivity,  but  the  mandatory  outcome  is  ensuring  “management  eontrols 
effectively  identify,  eorrect,  and  minimize  fraud,  waste,  and  abuse”  (DPAP,  201 1,  p.  2-2). 

To  minimize  risks,  the  management  and  internal  eontrols  should  have  support 
from  higher  levels,  expeet  integrity  and  ethieal  behavior  from  partieipants,  engage  in 
audits  annually,  ensure  eontrols  are  working  properly,  and  provide  proper  training,  both 
initial  and  refresher  (DPAP,  2011).  Following  the  guidelines  for  maintaining  those 
eontrols  will  ensure  that  eaeh  eomponent’s  program  has  strong  internal  eontrols,  eapable 
proeesses,  and  properly  trained  personnel  (Rendon  &  Rendon,  2014). 

One  of  the  management  eontrols  in  plaee  is  the  Purehase  Card  Online  System.  It 
is  a  DOD-wide  system  used  by  GPCP  users  to  improve  the  management  and 
aeeountability  within  eaeh  eomponent’s  GPCP  organization  (DPAP,  2011).  Additionally, 
the  DOD  has  many  resourees  that  require  management’s  complianee  with  speeifie  rules 
and  regulations  regarding  proeesses,  internal  eontrols,  and  training.  The  next  seetion 
discusses  the  aeeountability  methods  within  the  DOD  GPCP. 

b.  Department  of  Defense  Accountability  Methods  within  the  Government 

Purchase  Card  Program 

Adequately  trained  program  personnel  are  vital  to  maintain  aeeountability.  The 
roles  and  responsibilities  previously  outlined  in  the  federal  GPCP  seetion  are  applied  to 
the  DOD  as  well  as  to  DON  and  NPS.  An  AO  may  not  oversee  more  than  seven  CHs,  and 
an  A/OPC  may  not  be  responsible  for  more  than  300  aeeounts  (DPAP,  2011).  An 
individual  CH  or  AO  may  be  responsible  for  more  than  one  aeeount.  All  partieipants 
involved  in  a  purehase  eard  program  must  reeeive  training  mandated  by  the  GSA 
SmartPay  Program.  The  DOD-mandated  purehase  eard  eourse  is  titled  “DOD 
Government  Purchase  Card  Tutorial”  and  is  hosted  by  the  DAU  (DPAP,  2011).  The 
DAU  offers  two  online  eourses,  one  to  study  the  training  material  and  the  other  for 
refresher  training.  Eaeh  program  partieipant  must  produee  a  eertificate  of  eompletion  to 
the  APC  after  taking  the  online  test. 
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Now  that  the  DOD  application  of  the  purchase  card  has  been  discussed,  the  next 
section  reviews  the  purchase  card  program  application  of  one  of  DOD’ s  components,  the 
DON. 


3.  Department  of  the  Navy  Application  of  the  Government  Purchase 
Card  Program 

The  DON  GPCP  services  are  provided  by  a  task  order  issued  under  the  main  GSA 
SmartPay2  contract,  which  expires  November  2018  (Naval  Supply  Systems  Command 
[NAVSUP],  2012).  The  DON  instruction  applies  policy  guidance  from  10  U.S.C.  §  2784 
(2014);  0MB  (2009)  Circular  A-123,  Appendix  B;  and  the  DOD  government  charge  card 
guidebook  (DPAP,  2011).  These  policies  discuss  the  management  of  a  purchase  card 
program,  internal  controls  needed  to  manage  the  program,  and  penalties  for  violations  of 
the  GPCP  policies. 

The  DON  Consolidated  Card  Program  Management  Division  (CCPMD)  serves  as 
the  DON  Component  program  manager,  which  is  organizationally  aligned  within  the 
NAVSUP  Corporate  Operations  division  (FMO,  n.d.).  In  2012,  NAVSUP  disseminated 
an  instruction  guide  to  help  establish  DON  policy  for  management  of  the  GPCP.  In 
FY2001,  the  Navy  had  the  “second  largest  purchase  program  in  the  DOD,  with 
approximately  27,900  cardholders  making  2.8  million  transactions  valued  at  $1.8  billion” 
{Purchase  Cards,  2002,  p.  1;  GSA  SmartPay,  n.d.-c).  Twelve  years  later,  in  FY2013,  the 
program  had  10,200  cardholder  accounts,  made  130,000  transactions,  and  spent 
$128.57  million  in  purchases  (NAVSUP,  2013).  Like  the  DOD  program,  the  DON 
program  has  also  decreased  in  size,  which  is  not  unusual  given  the  current  fiscal 
environment.  Therefore,  with  this  current  fiscal  environment,  it  is  crucial  to  use  the 
program  efficiently  and  effectively.  The  NAVSUP  (2012)  Instruction  4200. 99B  outlines 
roles  and  responsibilities,  program  management,  use  of  the  purchase  card,  program 
oversight,  and  disciplinary  actions  associated  with  the  DON’s  application  of  the  GPCP, 
which  is  discussed  next. 
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a. 


Department  of  the  Navy  Roles  and  Responsibilities/T mining 


All  roles  and  responsibilities  are  similar  to  those  given  for  both  federal 
government  and  DOD  programs  to  include  A/OPC,  AO,  CH,  disbursing  paying  office, 
and  card-issuing  bank,  among  others  not  mentioned.  The  one  addition  is  that  the  A/OPC 
also  serves  as  a  liaison  to  the  DON  CCPMD.  In  accordance  with  NAVSUP  (2012) 
Instruction  4200. 99B,  all  CHs  and  AOs  must  receive  purchase  card  training  and  ethics 
training.  The  courses  are  role-  and  certification  system — specific.  Furthermore,  the  DON 
requires  that  its  program  participants  take  purchase  card  refresher  training  every  two 
years,  which  is  more  stringent  than  the  GSA  SmartPay  Program  requirement  of  every 
three  years,  and  annual  DOD  ethics  training.  The  DON  CCPMD  sponsored  regional 
training  is  one  way  for  program  participants  to  complete  the  purchase  card  refresher 
training  (NAVSUP,  2013).  Training  is  “key  to  ensuring  that  the  workforce  has  the  skills 
necessary  to  achieve  organizational  goals”  {Purchase  Cards,  2002,  p.  7).  The  next  section 
discusses  the  DON  GPCP  management. 

b.  Department  of  the  Navy  Government  Purchase  Card  Program 
Management 

The  DON  GPCP  management  is  comprised  of  personnel  requirements,  separation 
of  duties,  span  of  control,  training  requirements,  and  other  account  information,  which 
are  reflective  of  the  guidance  given  for  DOD  and  federal  government  programs.  Purchase 
card  program  personnel  must  be  civilian  government  employees  or  members  of  the  armed 
forces,  with  exceptions  given  to  some  specific  positions.  Separation  of  duties  aims  to 
limit  the  cross  interaction  of  AOs,  CHs,  and  A/OPCs  in  the  same  hierarchy.  Training 
requirements,  including  initial,  refresher,  and  ethics,  were  previously  discussed.  Once  the 
training  is  completed  and  documented,  the  participant  receives  authority  in  a  letter  of 
delegation  with  the  approved  spending  limit  for  the  position  in  which  the  CH  was  trained 
(NAVSUP,  2012).  Next,  the  DON  use  of  the  government  purchase  card  is  discussed. 

c.  Department  of  the  Navy  Use  of  the  Government  Purchase  Card 

As  previously  mentioned,  the  purchase  cards’  authorized  use  is  for  paying  for 
micro-purchases  ($3,000  limit)  of  supplies,  services,  or  construction  for  government  use 
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to  meet  the  government  organizations’  mission.  The  purehase  eard  is  to  be  used  only  for 
authorized  and  approved  purehases,  not  for  personal  use  purehases.  In  addition,  statutory 
requirements  must  be  met  in  order  to  use  the  purehase  eard  as  a  form  of  payment.  A  CH 
must  have  the  authority  to  purehase  goods  and  serviees  and  must  follow  DOD  and  DON 
purehasing  regulations.  Finally,  program  partieipants  must  be  in  eomplianee  with 
purehasing  internal  eontrols  when  purehasing  for  the  eommand  (NAVSUP,  2012). 

d.  Department  of  the  Navy  Government  Purchase  Card  Program  Oversight 

Program  oversight  is  “required  to  ensure  effeetiveness  of  purehasing  and 
management  internal  eontrols  and  ineludes  monthly,  quarterly,  and  semiannual  reviews” 
(NAVSUP,  2012,  p.  46).  This  ineludes  assuranees  from  both  CHs  and  AOs  regarding 
transaetion  reviews  and  aeeount  reeoneiliations.  There  are  proeedures  that  need  to  be 
followed  in  order  to  eorreetly  and  thoroughly  eonduet  aeeount  and  program  oversight. 

This  seetion  diseussed  the  DON  applieation  of  the  GPCP,  ineluding  roles  and 
responsibilities,  program  management,  use  of  the  purehase  eard,  and  the  DON  GPCP 
oversight.  As  previously  mentioned,  the  NPS  GPCP  will  be  diseussed  in  Chapter  III.  In 
order  for  the  GPCP  to  be  sueeessful,  there  must  be  suffieient  eorporate  govemanee, 
ineluding  auditability  and  adherenee  to  legislature  and  eurrent  praetiees,  whieh  will  be 
diseussed  next. 

E.  CORPORATE  GOVERNANCE 

This  seetion  of  the  literature  review  provides  an  overview  of  auditability, 
legislature,  and  eurrent  praetiees,  to  inelude  the  SOX  and  the  COSO.  This  seetion  is  the 
foundation  to  understand  the  internal  eontrols  governing  purehase  eard  programs. 

1.  Auditability 

Auditability  is  a  high-level  priority  for  the  DOD  beeause  it  demonstrates 
responsible  stewardship  of  taxpayers’  money,  reduees  eosts  of  business  operations,  and 
eomplies  with  eongressional  direetion  (Murphy- Sweet,  2013).  The  government  is  striving 
to  aehieve  auditability  by  September  30,  2017,  whieh  is  the  deadline  outlined  in  the 
National  Defense  Authorization  Aet  (NDAA)  for  FY2010.  To  reeeive  a  elean  audit  and 
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reach  financial  auditability  by  2017,  the  DOD  and  DON  implemented  an  audit  readiness 
initiative.  The  DON’S  audit  readiness  strategy  focuses  on: 


evaluating  business  processes  to  ensure  the  design  and  operation 
effectiveness  of  their  internal  controls  comply  with  federal  financial 
standards;  correcting  identified  internal  control  deficiencies;  ensuring  that 
internal  controls  remain  effective  through  continuous  monitoring,  testing, 
and  auditing;  and  retaining  key  supporting  documentation  demonstrating 
proper  execution  of  business  processes  for  inspection  at  all  levels.  (Patton, 

2013,  p.  23) 

As  reflected  in  this  initiative,  the  DON’s  audit  readiness  strategy  is  to  focus  on 
internal  controls.  Financial  Improvement  and  Audit  Readiness  (FIAR)  “supports  the 
DON’S  audit  readiness  initiative,  with  the  long-term  goal  of  improving  financial 
processes  and  systems  throughout  the  Navy,”  (Murphy-Sweet,  2013,  para.  2).  However, 
financial  auditability  is  not  the  only  goal.  Strong  and  effective  internal  controls, 
competent  people,  and  capable  processes  are  imperative  to  auditability  and  form  the  basis 
for  the  auditability  triangle,  which  is  illustrated  in  Figure  1  (Rendon  &  Rendon,  2014). 
The  focus  of  this  research  is  the  internal  controls  part  of  the  auditability  triangle. 


Figure  1.  Auditability  Triangle  (from  Rendon  &  Rendon,  2014) 
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In  relationship  to  internal  eontrols,  the  SOX  and  the  COSO  are  addressed  next. 


2,  Sarbanes-Oxley  Act  of  2002 

President  George  H.  W.  Bush  signed  the  SOX  into  law  in  2002  (Seeurities  and 
Exehange  Commission  [SEC],  2013).  The  SOX  was  enacted  to  “protect  investors  by 
improving  the  accuracy  and  reliability  of  corporate  disclosures  made  pursuant  to  the 
securities  laws,  and  for  other  purposes”  (Sarbanes-Oxley  Act,  2002).  More  specific  to 
internal  controls.  Section  404  addresses  management  assessment  of  internal  controls. 
Subsections  (a)  and  (b)  relate  to  the  rules  and  evaluation  and  reporting.  Section  404(a) 
mandated  that  each  annual  report  would  require  an  internal  control  report  including  a 
statement  of  management’s  responsibility  for  the  internal  control  structure  and 
procedures  as  well  as  an  assessment  of  the  internal  control  structure  at  year  end 
(Sarbanes-Oxley  Act,  2002,  §  7262(a)).  Section  404(b)  states  that  with  regard  to  the 
requirements  in  Subsection  (a),  “each  public  accounting  firm  that  prepares  or  issues  the 
audit  report  for  the  issuer  shall  attest  to,  and  report  on,  the  assessment  made  by  the 
management  of  the  issuer”  (2002,  §  7262(b)).  Although,  SOX  set  standards  for  public 
companies  and  public  accounting  firms  to  ensure  that  management  creates,  maintains, 
and  assesses  its  internal  control  structure,  the  internal  control  requirements  are  applicable 
to  private  companies  as  well  as  the  federal  government.  An  organization  that  provides 
guidance  on  internal  controls  is  addressed  next. 

3,  Committee  of  Sponsoring  Organizations  of  the  Treadway  Commission 

The  COSO  (n.d.-a)  was  organized  in  1985  and  consists  of  five  professional 
associations  dedicated  to  providing  comprehensive  frameworks  and  guidance  on  internal 
controls  to  improve  organizational  performance  and  governance.  COSO  is  comprised  of 
five  professional  organizations  to  include  the  American  Accounting  Association  (AAA), 
America,  Institute  of  Certified  Public  Accountants  (AICPA),  Einancial  Executives 
International  (EEI),  The  Institute  of  Management  Accountants  (IMA),  and  the  Institute  of 
Internal  Auditors  (IIA;  COSO,  n.d.-b).  COSO’s  (n.d.-a)  website  states  that  the 
organization’s  “goal  is  to  provide  thought  leadership  with  three  interrelated  subjects: 
enterprise  risk  management  (ERM),  internal  control,  and  fraud  deterrence”  (para.  6).  The 
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five  components  of  an  integrated  internal  control  system  are  discussed  next  as  outlined  by 
the  COSO  and  GAO. 

F.  INTERNAL  CONTROLS 

Internal  controls  in  the  government  are  a  continuous  built-in  component  of 
operations.  They  are  standards  in  place  to  ensure,  with  reasonable  assurance,  that  an 
organization’s  objectives  are  met  to  improve  accountability,  and  to  address  areas  of  risk 
in  the  organization.  The  definition  of  the  internal  control  framework,  along  with  the 
components  and  principles  of  internal  control  are  discussed  next. 

Internal  control  is  a  process  designed  to  provide  reasonable  assurance  that  an 
organization  will  achieve  “effectiveness  and  efficiency  of  operations,  reliability  of 
financial  reporting,  and  compliance  with  applicable  laws  and  regulations”  (COSO,  2013; 
GAO,  1999,  p.  4).  There  is  a  direct  relationship  between  the  three  categories  of 
objectives,  which  are  what  an  entity  strives  to  achieve,  and  components,  which  represent 
what  is  needed  to  achieve  the  objectives”  (COSO,  1992,  p.  3). 

Snyder,  Broome,  and  Zimmerman  (1989)  emphasize  that  “finding  the  appropriate 
level  of  internal  control  is  a  critical  management  responsibility”  (p.  49).  Salerno  (2006) 
finds  that  “appropriate,  properly  functioning  internal  controls  offer  powerful  benefits”  to 
organizations  in  many  ways  (p.  1).  Furthermore,  Snyder  et  al.  (1989)  states  that  “internal 
control  must  be  used  in  a  consistent  manner”  throughout  the  organization  (p.  48). 

The  five  components  of  an  integrated  internal  control  framework  are  control 
environment,  risk  assessment,  information  and  communication,  control  activities,  and 
monitoring  activities  (COSO,  2013).  Recently,  COSO  (2013)  released  an  updated 
Internal  Control — Integrated  Framework  (Framework),  which  identifies  17  principles 
that  represent  fundamental  concepts  within  each  component.  Appendix  B  reflects  the 
integrated  internal  control  components  and  related  principles  (Tan,  2013).  In  addition,  the 
Government  Accountability  Office  (GAO,  2013)  exposure  draft  incorporates  the  new 
COSO  guidelines,  which  are  discussed  later.  Each  of  the  five  internal  control  components 
and  17  principles  are  discussed  in  the  following  sections. 
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1. 


Control  Environment 


The  control  environment  is  the  first  internal  control  component  and  is  considered 
the  foundation  of  any  internal  control  system  as  well  as  the  entire  organization. 
Management  and  employees  are  responsible  for  establishing  and  maintaining  an 
environment  that  sets  a  positive  tone  toward  internal  controls  (GAO,  2001).  There  are 
several  key  factors  that  support  the  achievement  of  this  goal,  including  integrity  and 
ethical  values,  commitment  to  competence,  management’s  operating  style,  and 
organizational  structure.  Management  must  establish  a  tone  at  the  top  that  values  ethical 
behavior  and  integrity  and  must  ensure  that  the  desired  behaviors  are  communicated 
throughout  the  organization.  Holmes,  Langford,  Welch,  and  Welch  (2002)  propose  that 
management  must  encourage  cooperation  in  achieving  a  moral  purpose  through 
ethical  behavior.  Therefore,  a  strong,  supportive  attitude  by  management  toward 
tight  internal  controls  should  discourage  unethical  activity  (Holmes  et  al.,  2002). 
Management  should  also  take  timely  and  appropriate  action  as  soon  as  there  are  signs  that 
a  problem  may  exist  (GAO,  2001). 

The  organization  must  also  seek  competence  for  its  workforce.  This  entails 
identifying  suitable  knowledge  and  skills  needed  for  various  jobs  and  providing  the 
required  training  (GAO,  1999).  Furthermore,  management’s  philosophy  and  operating 
style  affect  the  environment  as  it  determines  the  organization’s  attitude  toward  risk¬ 
taking  and  performance-based  management.  These  factors  can  have  a  great  impact  on 
internal  control.  A  study  by  Fleak,  Harrison,  and  Turner  (2010)  illustrated  “how 
weaknesses  in  the  control  environment  component  of  the  COSO  framework  can  cause  or 
exacerbate  weaknesses  in  the  control  activities,  information  and  communications,  and 
monitoring  components  of  the  framework”  (p.  715).  The  organization  must  have  clearly 
defined  reporting  relationships  and  clearly  defined  authority  and  responsibility,  and  must 
ensure  that  the  organization  is  appropriately  centralized  or  decentralized  (GAO,  2001). 
Additionally,  Fleak  et  al.  (2010)  illustrate  that  “internal  control  is  vital  for  organizations 
of  all  sizes”  (p.  714).  Each  of  the  five  internal  control  component  sections  discusses  the 
associated  principles  outlined  in  the  COSO  (2013)  Framework.  The  principles  relating  to 
control  environment  are  as  follows: 
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•  Principle  1 — The  organization  demonstrates  a  eommitment  to  integrity 
and  ethieal  values. 

•  Prineiple  2 — The  board  of  direetors  demonstrates  independenee  from 
management  and  exercises  oversight  of  the  development  and  performanee 
of  internal  control. 

•  Principle  3 — Management  establishes,  with  board  oversight,  structures, 
reporting  lines,  and  appropriate  authorities  and  responsibilities  in  the 
pursuit  of  objeetives. 

•  Prineiple  4 — The  organization  demonstrates  a  eommitment  to  attract, 
develop,  and  retain  eompetent  individuals  in  alignment  with  objeetives. 

•  Prineiple  5 — The  organization  holds  individuals  aeeountable  for  their 
internal  control  responsibilities  in  the  pursuit  of  objectives,  (p.  6) 

2,  Risk  Assessment 

Risk  assessment  is  the  seeond  internal  eontrol  eomponent  whieh  ineludes  the 
“identifieation,  analysis,  and  management  of  risk”  (Chang,  2013,  p.  16)  assoeiated  with 
an  organization.  Risk  eould  inhibit  the  organization’s  effieient  and  effeetive  ability  to 
achieve  its  objectives.  Risk  identifieation  ineludes  reeognizing  signifieant  interaetions 
between  the  organization  and  external  factors  as  well  as  internal  faetors  at  both  the  entity 
level  and  activity  level.  Other  factors  identified  that  may  eontribute  to  risks  are  activities 
related  to  past  failures,  the  inherent  nature  of  the  organization’s  mission,  and  the 
eomplexity  of  programs  (GAO,  2001).  The  analysis  of  risk  also  ineludes  estimating  the 
signifieanee  of  the  risk  and  assessing  the  likelihood  and  frequeney  of  the  risk  (GAO, 
2001).  When  analyzing  risk,  management  needs  to  develop  a  tolerable  level  of  risk  for 
the  organization  to  aeeept  and  manage.  The  management  of  risk  entails  deeiding  whieh 
internal  eontrol  aetivities  would  best  mitigate  those  risks  and  helps  aehieve  the  internal 
eontrol  objeetives  of  effieient  and  effeetive  operations,  reliable  finaneial  reporting,  and 
eompliance  with  laws  and  regulations  (GAO,  2001).  The  new  COSO  (2013)  Framework 
prineiples  relating  to  risk  assessment  are  listed  as  follows: 

•  Prineiple  6 — The  organization  speeifies  objeetives  with  suffieient  elarity 
to  enable  the  identifieation  and  assessment  of  risks  relating  to  objectives. 

•  Principle  7 — The  organization  identifies  risks  to  the  achievement  of  its 
objeetives  aeross  the  entity  and  analyzes  risks  as  a  basis  for  determining 
how  the  risks  should  be  managed. 
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•  Principle  8 — The  organization  eonsiders  the  potential  for  fraud  in 
assessing  risks  to  the  aehievement  of  objeetives. 

•  Prineiple  9 — The  organization  identifies  and  assesses  ehanges  that  eould 
signifieantly  impaet  the  system  of  internal  control,  (p.  7) 

3.  Control  Activities 

Control  activities  is  the  third  internal  eontrol  eomponent  and  eonsists  of  the 
“polieies,  procedures,  teehniques,  and  mechanisms  to  ensure  that  management’s 
directives  for  the  organization  are  earried  out”  (GAO,  1999,  p.  11).  The  polieies, 
proeedures,  teehniques,  and  mechanisms  are  also  intended  to  mitigate  the  risk  identified 
in  the  risk  assessment  proeess.  Control  aetivities  take  plaee  at  all  levels  of  an 
organization,  which  include  a  variety  of  aetivities.  A  manager  should  consider  “whether 
eontrol  aetivities  relate  to  the  risk-assessment  proeess  and  whether  they  are  appropriate  to 
ensure  the  management’s  direetives  are  earried  out”  (GAO,  2001,  p.  33).  A  reviewer 
within  the  organization  determines  if  the  proper  eontrol  aetivities  are  in  plaee,  if  there  are 
a  suffieient  amount  of  eontrol  proeedures,  and  if  they  are  funetioning  effeetively.  It  is 
important  to  establish  eontrol  aetivities,  but  also  to  understand  them,  monitor  them,  and 
ensure  they  are  being  applied  appropriately  and  working  properly. 

Other  eommon  eategories  of  eontrol  aetivities  inelude  management  of  human 
eapital,  performanee  measures,  and  segregation  of  duties.  It  is  imperative  that  the 
organization’s  mission,  expeetations,  and  strategies  be  elearly  eommunieated  to  all 
employees  so  that  the  organization  ean  manage  the  workforee  to  achieve  its  goals. 
Performanee  measures  should  be  established  throughout  the  organization  and  eontinually 
eompared  against  planned  goals  to  assess  progress.  Performanee  measures  are  also  used 
for  operational  and  finaneial  reporting  purposes.  Segregation  of  duties  ean  help  to  reduee 
the  risk  of  fraud,  waste,  and  abuse  but  solely  “relying  on  segregation  of  duties  where  the 
eontrol  environment,  monitoring,  or  risk  assessment  is  weak  is  negligent”  (MeCuaig  & 
Marks,  2005,  p.  37).  All  of  these  faetors  impaet  an  organization’s  internal  eontrol 
activities,  “whieh  should  be  designed  aecordingly  to  eontribute  to  the  achievement  of  the 
organization’s  missions,  goals,  and  objeetives”  (GAO,  2001,  p.  33).  In  addition  to  the 
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control  activities  discussed,  the  following  are  the  COSO  (2013)  Framework  prineiples 
relating  to  eontrol  aetivities: 

•  Prineiple  10 — The  organization  seleets  and  develops  eontrol  aetivities  that 
eontribute  to  the  mitigation  of  risks  to  the  aehievement  of  objeetives  to 
aeeep table  levels. 

•  Prineiple  11 — The  organization  seleets  and  develops  general  eontrol 
aetivities  over  teehnology  to  support  the  aehievement  of  objeetives. 

•  Prineiple  12 — The  organization  deploys  eontrol  aetivities  through  polieies 
that  establish  what  is  expeeted  and  proeedures  that  put  polieies  into  aetion. 
(p.  7) 

4.  Information  and  Communication 

Information  and  eommunieation  is  the  fourth  internal  eontrol  eomponent. 
Information  and  eommunieation  is  the  eolleetion  of  information  that  is  sent  to  all  the 
organization’s  stakeholders  through  the  appropriate  ehannels,  both  internal  and  external. 
Information  needs  to  be  “identified,  eaptured,  and  distributed  to  the  right  people 
in  suffieient  detail,  in  the  right  form,  and  at  the  appropriate  time  to  enable  them  to  earry 
out  their  duties  and  responsibilities  effieiently  and  effeetively”  (GAO,  2001,  p.  51). 
Managers  need  two  types  of  information:  operating  and  finaneial  (GAO,  2001). 
Operating  information  is  used  to  determine  eomplianee  with  various  laws  and 
regulations,  whereas  finaneial  information  is  used  to  make  operating  deeisions  on  a 
daily  basis  and  alloeate  resourees.  Information  and  eommunieation  also  ineludes  an 
organization’s  aeeounting  system.  An  effeetive  information  and  eommunieation  system 
should  allow  information  to  flow  up,  down,  and  aeross  the  organization  (GAO,  1999). 
Williams  (2005)  eontends  that  “information  and  eommunieation  hold  the  COSO 
framework  together.  Colleeting,  analyzing,  and  using  performanee  measures  for  deeisions 
are  aetivities  that  require  internal  eontrols  to  ensure  the  data  used  are  valid  and  reliable,” 
(pp.  16-17). 

Management  should  ensure  that  internal  and  external  eommunieations  are  taken 
seriously,  that  there  is  a  means  of  eommunieation  outside  the  direet  supervisor,  and  that 
employees  know  how  their  roles  fit  into  the  overall  strueture  of  the  organization.  The 
organization  should  “eontinually  improve  the  usefulness  and  reliability  of  its 
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communication  of  information”  (GAO,  2001,  p.  55)  because  it  is  eonneeted  to  the 
organization’s  overall  strategie  plan  and  is  eonsequently  linked  to  the  aeeomplishment  of 
the  organization’s  objeetives.  In  addition  to  the  eomponents  of  information  and 
eommunieation  diseussed,  the  COSO  (2013)  Framework  prineiples  relating  to 
information  and  eommunieation  are  as  follows: 

•  Prineiple  13 — The  organization  obtains  or  generates  and  uses  relevant, 
quality  information  to  support  the  funetioning  of  internal  eontrol. 

•  Prineiple  14 — The  organization  internally  eommunieates  information, 
ineluding  objeetives  and  responsibilities  for  internal  eontrol,  neeessary  to 
support  the  funetioning  of  internal  eontrol. 

•  Prineiple  15 — The  organization  eommunieates  with  external  parties 
regarding  matters  affeeting  the  funetioning  of  internal  eontrol.  (p.  7) 

5.  Monitoring  Activities 

Monitoring  aetivities  is  the  fifth  internal  eontrol  eomponent  and  is  the  proeess  of 
assessing  the  quality  of  an  organization’s  performanee  over  time.  Williams  (2005) 
identifies  monitoring  as  “the  proeess  of  assessing  the  quality  of  internal  eontrol 
performanee.  Monitoring  is  also  the  routine  review  of  the  effeetiveness  of  internal 
eontrols  and  is  perhaps  the  most  important  part  of  the  COSO  framework,”  (p.  17). 
Monitoring  is  aeeomplished  through  ongoing  monitoring,  separate  evaluations,  or  a 
eombination  of  the  two.  Ongoing  monitoring  is  performed  eontinually  and  is  embedded 
in  the  organization’s  normal  operations.  It  ineludes  “regular  management  and  supervisory 
aetivities,  eomparisons,  reeoneiliations,  and  other  aetions  people  take  in  performing  their 
duties”  (GAO,  1999,  p.  20).  Separate  evaluations  are  a  more  in-depth  review  of  a  single 
internal  eontrol  proeess  at  a  speeifie  point  in  time.  Separate  evaluations  ean  be  eondueted 
by  an  internal  individual  as  a  self-assessment  or  by  an  external  auditor.  Any  internal 
eontrol  defieieneies  that  are  found  need  to  be  reported  to  the  person  responsible  for  that 
funetion  and  his  or  her  supervisor  for  immediate  resolution. 

Audit  resolution  ineludes  findings  and  reeommendations  from  formal  audits, 
informal  reviews,  internal  separate  evaluations,  and  management  studies  and  assessments 
(GAO,  2001).  The  organization  should  be  responsive  to  these  reeommendations,  find 
ways  to  strengthen  its  internal  eontrols,  and  take  appropriate  aetion  to  follow  up  and 


28 


resolve  any  issues.  The  COSO  Framework  (2013)  updated  this  eomponent  to 
“Monitoring  Aetivities”  in  2013,  diseussing  the  same  eoneepts,  with  the  addition  of  the 
following  prineiples: 

•  Prineiple  16 — The  organization  seleets,  develops,  and  performs  ongoing 
and/or  separate  evaluations  to  aseertain  whether  the  eomponents  of 
internal  eontrol  are  present  and  funetioning. 

•  Prineiple  17 — The  organization  evaluates  and  eommunieates  internal 
eontrol  defieieneies  in  a  timely  manner  to  those  parties  responsible  for 
taking  eorreetive  aetion,  ineluding  senior  management  and  the  board  of 
direetors,  as  appropriate,  (p.  7) 

The  previous  seetions  diseussed  the  five  internal  eontrol  eomponents  and  the 
eorresponding  prineiples  in  aeeordanee  with  the  updated  COSO  Framework.  These  five 
eomponents  of  internal  eontrol  are  important  to  the  purehase  eard  program’s  sueeess 
beeause  the  absenee  of  effeetive  internal  eontrols  ean  expose  the  program  to 
ineffioieneies  and  vulnerabilities  to  fraud  (Rendon,  2011,  p.  11).  The  next  seetion 
diseusses  the  GAO  standards  in  the  GAO  2013  exposure  draft  as  they  were  developed 
from  and  relate  to  the  COSO  Framework. 

G.  INTERNAL  CONTROLS  IN  THE  FEDERAL  GOVERNMENT 

1.  Government  Accountability  Office  Internal  Control  Framework 

The  GAO  internal  eontrol  framework  is  the  COSO  Framework  applied  to  the 
federal  government.  Prior  GAO  reports  were  refereneed  in  the  previous  seetions  of 
diseussion  of  the  internal  eontrol  eomponents;  however,  a  new  set  of  internal  eontrols 
standards  was  released  by  GAO  (2013)  as  an  exposure  draft  of  the  Standards  for  Internal 
Control  in  the  Federal  Government  {Green  Book)  that  implements  the  new  COSO 
integrated  internal  eontrol  framework.  GAO  is  eurrently  in  the  proeess  of  updating  the 
Green  Book.  The  GAO  exposure  draft  of  the  Green  Book  was  open  to  the  publie  for 
eomments  through  February  18,  2014,  so  the  GAO  will  be  releasing  the  new  standards 
sometime  this  year  and  will  supersede  the  1999  edition  of  the  Green  Book.  These 
standards  provide  the  framework  for  establishing  and  maintaining  effeetive  internal 
eontrols  in  the  federal  government  (GAO,  2013). 
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The  goal  is  to  develop  an  effective  internal  control  system  to  achieve  an 
organization’s  goals;  however,  it  is  imperative  to  understand  that  the  control  system  can 
only  provide  reasonable  assurance,  not  absolute  assurance,  that  those  objectives  will  be 
met.  The  GAO  2013  exposure  draft  details  the  implementation  of  the  internal  control 
components  and  principles  in  a  federal  government  environment  similar  to  the 
implementation  discussed  in  the  previous  sections.  The  next  section  discusses  the 
Managers’  Internal  Control  Program  (MICP),  which  is  another  tool  used  to  hold  federal 
managers  accountable  for  their  internal  control  system. 

2,  Managers’  Internal  Control  Program 

The  Federal  Managers’  Financial  Integrity  Act  (FMFIA)  of  1982  was  signed  into 
law  to  ensure  that  agencies  were  conducting  ongoing  evaluations  and  reporting  on  the 
adequacy  of  their  internal  control  systems.  The  Office  of  the  Under  Secretary  of  Defense 
(Comptroller;  OUSD[C])  is  responsible  for  implementing,  managing,  and  monitoring  the 
secretary  of  defense’s  program  over  internal  control  management  (2013a).  Although  the 
USD(C)  is  responsible  for  the  program,  he/she  instructs  the  director  of  financial 
improvement  and  audit  readiness  (DFIAR)  to  manage  and  oversee  operations  of  the 
DOD’s  MICP  (OUSD[C]/Chief  Financial  Officer,  2013b).  The  FMFIA  is  implemented 
through  the  DOD  MICP  (OUSD[C],  2013a).  The  MICP  requires  all  DOD  managers  to  be 
involved  in  the  program  and  remain  active  participants  to  “review,  assess,  and  report  on 
the  effectiveness  of  internal  management  controls  within  their  command”  (OUSD[C], 
2013b,  p.  1).  The  MICP  is  the  Navy’s  method  for  demonstrating  compliance  with  the 
FMFIA,  and  it  is  crucial  to  stay  in  compliance  with  this  program  because  the  command 
compliance  will  be  reviewed  and  evaluated  during  external  audits  and  inspections  (NPS, 
2013a). 

The  NPS  Instruction  5200. IS  states,  as  outlined  in  Title  31  of  the  United  States 
Code  (U.S.C.)  §  3512  (2011),  the  following  regarding  internal  controls: 

requires  commands  to  implement  a  system  of  internal  controls  to  provide 
reasonable  assurance  that  programs  achieve  their  intended  results; 
resource  use  is  consistent  with  the  Department  of  the  Navy  mission; 
programs  and  resources  are  protected  from  waste,  fraud,  and 


30 


mismanagement;  laws  and  regulations  are  followed;  and  reliable  and 
timely  information  is  obtained,  maintained,  and  used  for  deeision-making 
and  reporting.  (NFS,  2013a,  p.  1) 

The  implementation  of  internal  eontrol  systems  were  previously  required  of 
federal  managers,  but  now  reporting  is  an  additional  obligation  and  will  eontinue  to  be  a 
requirement  to  support  the  auditability  of  the  DOD.  The  0MB  (2009)  Cireular  A-123  and 
its  Appendix  B  further  discuss  management’s  responsibility  for  internal  controls. 

3.  Office  of  Management  and  Budget  Circular  A-123 

0MB  (2004)  Circular  A-123,  Management’s  Responsibility  for  Internal  Control, 
was  previously  named  Management  Accountability  and  Control.  It  outlined  and  defined 
management’s  responsibility  for  internal  control  in  the  federal  government.  This  revision 
of  the  circular  was  written  in  2004  after  the  new  requirements  for  publicly  traded 
companies  were  established  in  the  SOX;  however,  the  circular  was  not  implemented  until 
FY2006.  Agencies  were  given  time  to  prepare  for  its  implementation,  and  in  the  interim 
followed  the  previous  version  of  Circular  A-123  (0MB,  2004).  The  revised  0MB 
Circular  A-123  was  to  supersede  all  previous  versions  once  implemented.  At  the  time, 
this  circular  and  the  statute  it  implemented,  FMFIA  of  1982,  were  the  core  federal 
requirements  to  improve  internal  controls  (0MB,  2004).  The  content  of  the  circular  was 
meant  to  strengthen  the  requirements  for  assessment  of  internal  controls  and  emphasize 
the  connection  between  internal  control  assessments  and  internal  control-related  activities 
(0MB,  2004). 

Appendix  B  of  Circular  A-123  was  “Improving  the  Management  of  Government 
Charge  Card  Programs”  (0MB,  2004).  The  revised  Appendix  B  outlined  policies  and 
procedures  regarding  how  to  maintain  internal  controls  in  government  charge  card 
programs  (0MB,  2009).  It  established  minimum  requirements  and  identified  best 
practices  from  all  issuing  agencies,  such  as  the  0MB,  GSA,  Department  of  Treasury,  and 
others.  The  goal  of  the  guidance  was  to  improve  the  GPCP  and  maximize  the  benefits  to 
the  federal  government.  Benefits  included  reduction  of  administrative  costs,  decrease  in 
transaction  time  and  costs,  mitigation  of  risks,  improvement  of  financial  and 
administrative  processes,  and  policy  compliance  monitoring  (0MB,  2009).  The 
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information  contained  in  the  0MB  Circular  A- 123  Appendix  B  must  be  distributed  to  all 
employees  in  the  purchase  card  program  and  “included  in  internal  ageney  proeedures  and 
training  materials”  (0MB,  2009,  p.  3). 

H.  SUMMARY 

This  literature  review  presented  a  baekground  of  the  research  with  an  overview  of 
the  evolving  role  of  the  purchasing  function.  It  also  presented  the  industry  purehase  eard 
program  and  its  assoeiated  roles  and  responsibilities.  In  addition,  the  GPCP  and  its 
applieation  in  the  federal  government,  the  DOD,  and  the  DON  were  discussed.  Corporate 
govemanee,  whieh  ineluded  auditability,  the  SOX  and  COSO  were  addressed. 
Furthermore,  the  integrated  internal  control  components  were  discussed  and  as  well  as 
internal  eontrols  in  the  federal  government. 

The  next  ehapter  introduees  the  Naval  Postgraduate  Sehool  (NPS)  and  its  use  of 
the  GPCP.  NPS  is  the  foeal  organization  for  this  researeh  on  the  analysis  of  pereeptions 
of  internal  eontrols  in  the  GPCP. 
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III.  NAVAL  POSTGRADUATE  SCHOOL 


A,  INTRODUCTION 

The  Naval  Postgraduate  Sehool  (NPS)  is  loeated  in  Monterey,  CA.  The  sehool 
provides  graduate  education  to  U.S.  and  foreign  military  officers  and  government 
employees.  NPS’s  mission  is  to  “provide  relevant  and  unique  advanced  education  and 
research  programs”  (CNO,  2012,  p.  3),  and  through  this  mission,  NPS  fulfdls  the 
graduate  education  needs  of  the  Department  of  Defense  (DOD).  The  institution  is 
comprised  of  four  schools,  several  departments,  and  a  number  of  centers,  all  of  which 
have  staff,  faculty,  and  students  with  purchasing  requirements  who  are  working  to 
accomplish  their  specific  mission,  which  supports  NPS’s  mission. 

The  staff  at  the  school  supports  the  operations  of  NPS  in  functional  areas 
including,  but  not  limited  to,  contracting  and  purchasing.  The  Department  of  Contracting 
and  Logistics  governs  the  contracting  and  purchasing  functions  for  all  of  NPS,  and  the 
staff  in  the  department  supports  the  purchasing  requirements  for  NPS  schools, 
departments,  and  centers.  This  chapter  will  provide  a  discussion  of  the  Contracting  and 
Logistics  Department  and  NPS’s  purchasing  organizational  structure.  Finally,  the  GPCP 
at  NPS  is  discussed,  including  the  span  of  control,  training  requirements,  and 
administrative  actions  for  noncompliance. 

B,  CONTRACTING  AND  LOGISTICS  MANAGEMENT 

A  recently  released  NPS  instruction  states,  “Under  the  direction  of  the  Director  of 
Contracting  and  Logistics  Management,  the  Contracting  and  Logistics  Management 
organization  provides  procurement  and  contracting  support  for  the  acquisition  of  supplies 
and  services  for  the  Naval  Postgraduate  School”  (NPS,  2013b,  p.  13).  The  organization 
was  recently  restructured  to  enhance  efficiency  and  effectiveness  within  the  department, 
as  well  as  provide  clarity  for  the  employees  and  end  users.  As  previously  mentioned,  all 
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staff,  faculty,  and  students  have  purehasing  requirements  in  order  to  eomplete  their 
speeifie  mission,  whieh  supports  NFS’s  mission.  To  aoeomplish  the  mission  of  NFS,  the 
staff  involved  in  the  purehasing  funetion  must  be  properly  equipped  with  the  right  tools. 
The  purehasing  organizational  strueture,  whieh  differentiates  the  two  types  of  purehasing 
support  provided  at  NFS,  is  diseussed  next. 

C.  PURCHASING  ORGANIZATIONAL  STRUCTURE  AT  THE  NAVAL 

POSTGRADUATE  SCHOOL 

Purehasing  in  support  of  NPS  is  organized  into  a  hybrid  strueture,  whieh  is  an 
organizational  design  that  provides  flexibility  to  meet  ehanging  business  eonditions 
(Monzeka  et  al.,  2011).  Organizational  design  refers  to  the  proeess  of  seleeting  a 
“struetured  and  formal  system”  that  ineorporates  eommunieation,  eontrol,  authority,  and 
other  responsibilities  needed  to  aoeomplish  the  organization’s  goals  (Monzeka  et  al., 
2011).  Monzeka  et  al.  (2011)  oontended  that  “one  of  the  most  oritioal  aspeots  of 
organizational  design  is  the  deoision  to  oentralize  or  deoentralize  purehasing  authority” 
(p.  158).  The  purehasing  authority  at  NPS  is  a  hybrid  beoause  it  has  both  oentralized 
and  deoentralized  aspeots.  The  purehasing  agents  who  are  mostly  responsible  for  large 
orders  ranging  from  $3,000-$150,000  are  oentralized,  whereas  the  purohase  oardholders 
(CHs)  who  are  responsible  for  the  small  orders  under  the  mioro-purohase  threshold  of 
$3,000  are  deoentralized. 

In  FY2012,  the  NPS  Government  Purohase  Card  Program  (GPCP)  was 
responsible  for  making  approximately  21,000  transaotions  totaling  approximately 
$24.2  million  (M.  Morales,  personal  oommunioation,  July  24,  2013).  Both  purehasing 
agents  and  government  purohase  CHs  report  to  the  direotor  of  oontraoting  and  logistics 
management  (NPS,  2013b).  The  GPCP  at  NPS  is  diseussed  next,  whieh  inoludes  span  of 
eontrol,  training  requirements,  and  administrative  aotions  for  nonoomplianoe. 
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D,  NAVAL  POSTGRADUATE  SCHOOL  GOVERNMENT  PURCHASE 

CARD  PROGRAM 

The  Department  of  Contraeting  and  Logistics  Management  owns  the  NPS  GPCP, 
but  the  agency  program  coordinator  (APC)  has  overall  responsibility  of  the  program  to 
ensure  its  integrity  and  success.  The  APC’s  responsibility  is  to  ensure  all  program 
participants,  specifically  approving  officials  (AOs)  and  CHs,  are  properly  equipped  with 
the  knowledge,  skills,  and  abilities  to  accomplish  their  purchasing  requirements.  The 
APC  is  also  responsible  for  tracking  training  completion,  ensuring  that  proper  oversight 
and  management  controls  are  in  place  and  working,  and  conducting  compliance  reports. 
The  APC  is  tasked  with  making  sure  that  AOs  and  CHs  complete  the  mandatory  training 
requirements  (including  refresher  training  when  necessary),  remain  familiar  with  all 
policies  and  procedures  associated  with  the  program,  and  are  aware  of  the  internal 
controls  in  place.  The  following  sections  will  discuss  span  of  control,  training 
requirements,  and  administrative  actions  for  noncompliance  regarding  the  GPCP  at  NPS. 

1.  Span  of  Control 

The  NPS  GPCP  is  composed  of  a  total  of  24  AOs  and  32  CHs  dispersed 
throughout  the  campus  to  serve  their  departments’  customers.  The  responsibilities  of  an 
AO  and  a  CH  are  collateral  duties  to  be  performed  in  conjunction  with  primary  duties. 
Given  the  ratio  of  CHs  to  AOs  at  NPS,  an  AO  is  responsible  for  overseeing  no  more  than 
two  CHs,  which  complies  with  current  DON  regulation  on  span  of  control,  which 
specifies  that  an  AO  may  not  oversee  more  than  seven  CHs  (NAVSUP,  2012).  In 
addition,  the  DON  instruction  states  that  an  APC  may  not  oversee  more  than  300  AOs,  so 
NPS  is  also  in  compliance  with  that  requirement. 

2.  Training  Requirements 

NPS  (2012)  Instruction  4410. 1C  outlines  the  training  requirements  for  its  AOs 
and  CHs.  After  the  passing  of  the  2006  Consolidated  Appropriations  Act,  the  requirement 
for  credit  worthiness  assessments  for  new  CHs  was  eliminated  (DPAP,  2011;  Rendon, 
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2011).  However,  agency  officials  and  APCs  are  allowed  to  continue  implementing  this 
requirement  at  their  discretion  (Rendon,  2011).  Credit  worthiness  assessments  are  not 
required  for  new  CHs  at  NPS. 

Required  training  for  AOs  and  CHs  at  NPS  align  with  the  requirements  for  the 
DON.  Those  requirements  include  a  course  from  the  Defense  Acquisition  University 
(DAU),  online  DON  purchase  card  training  for  their  specific  role,  and  DOD  ethics 
training  (NAVSUP,  2012).  In  addition,  purchase  card  refresher  training  is  required  every 
two  years,  which  can  be  completed  through  the  Consolidated  Card  Program  Management 
Division  (CCPMD)  sponsored  regional  training,  specific  DAU  courses,  or  online  DON 
purchase  card  training.  Furthermore,  DOD  annual  ethics  training  is  required  as  well. 
Initial  training  with  Citibank  is  required,  and  NPS  also  requires  that  all  purchase  card 
personnel  attend  local  annual  procedures  training.  Lastly,  all  new  cardholders  must 
complete  a  class  on  using  Funds  Administration  and  Standardized  Document  Automation 
(FASTDATA)  and  the  Kuali  Financial  System  (KFS).  The  FASTDATA  is  used  as  NFS’s 
financial  management  tool  to  input  purchase  card  transactions  into  the  Standard 
Accounting  and  Reporting  System  (STARS).  The  KFS  is  used  as  the  business 
management  system  for  NPS  (NPS,  2013b). 

3.  Administrative  Actions  for  Noncompliance 

If  the  AO  and/or  CH  do  not  comply  with  appropriate  regulations  and  policies, 
administrative  actions  will  be  taken.  NPS  (2008)  Instruction  4200.1 A,  titled  Navy 
Purchase  Card  Rule  Violations  and  Applicable  Administrative  Actions,  identifies  two 
types  of  card  violations  and  associated  administrative  actions.  The  APC  is  responsible  for 
informing,  investigating,  and  confirming  all  violations  to  the  appropriate  leadership 
(NPS,  2008).  Category  “A”  violations  occur  when  AOs  and  CHs  fail  to  adhere  to  proper 
record  keeping  and  training  requirements,  whereas  Category  “B”  violations  occur  when 
AOs  and  CHs  violate  purchasing  rules  and  regulations.  The  administrative  actions  for  a 
Category  A  violation  depend  on  whether  it  is  the  first,  second,  or  third  violation.  The  first 
violation  requires  corrective  action,  the  second  violation  may  result  in  a  suspended 
account  and  required  remedial  training,  and  the  third  violation  results  in  a  cancelled 
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account  for  the  CH  and  a  suspended  account  for  the  AO.  Based  on  the  results  of  a 
Category  B  violation,  the  comptroller  may  immediately  caneel  the  account  and  provide 
guidanee  and  additional  training  (NFS,  2008). 


E.  SUMMARY 

This  chapter  presented  a  brief  overview  of  NFS,  including  its  mission  and 
purchasing  requirements.  In  addition,  a  discussion  of  the  Contracting  and  Logistics 
Department  and  its  purehasing  organizational  structure  was  provided.  Finally,  the  GFCF 
at  NFS  was  diseussed  including  the  span  of  eontrol,  training  requirements,  and 
administrative  actions  for  noncompliance.  The  next  chapter  presents  the  methodology  of 
this  researeh. 
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IV.  METHODOLOGY 


A,  INTRODUCTION 

This  chapter  provides  an  outline  of  the  methodology  used  to  eonduct  this  researeh 
study.  The  method  used  to  develop  the  survey,  the  sourees  used  to  develop  the  individual 
questions  used  in  the  survey  instrument,  and  the  deployment  of  the  survey  are  diseussed. 
The  process  used  to  analyze  the  data  is  also  addressed. 

B.  SURVEY  DEVELOPMENT 

The  survey  was  developed  using  two  sourees.  The  first  souree  was  a  previously 
validated  survey  developed  by  the  New  York  State  Internal  Control  Assoeiation 
(NYICA;  2011).  Questions  from  the  survey  that  were  most  pertinent  to  the  five 
eomponents  of  internal  eontrol  were  utilized.  The  seeond  souree  was  questions  developed 
by  the  researeh  team.  Demographie  questions  and  additional  questions  based  on  the 
information  provided  in  the  literature  review  eondueted  on  the  government  purehase  eard 
program  were  developed.  The  survey  eonsisted  of  69  Likert-based  survey  items  with 
seven  options  ranging  from  “Strongly  Agree”  to  “Strongly  Disagree.”  The  partieipants 
also  had  the  option  to  ehoose  “I  don’t  know”  or  “I  prefer  not  to  answer,”  which  were  part 
of  the  seven  options. 

The  survey  was  developed  to  analyze  the  approving  offieials’  (AOs)  and 
eardholders’  (CHs)  pereeptions  of  internal  eontrols  within  the  purehase  eard  program  at 
the  Naval  Postgraduate  Sehool  (NPS).  First,  the  demographie  questions  addressed  the 
partieipants’  employment  category,  position  in  the  Government  Purehase  Card  Program 
(GPCP),  time  in  their  position,  numbers  of  schools/departments/people  they  support  or 
oversee,  and  pereentage  of  their  working  hours  that  were  spent  eondueting  GPCP 
eollateral  duties.  Seeond,  the  survey  foeused  on  questions  relating  to  the  five  eomponents 
of  the  Committee  of  Sponsoring  Organization  of  the  Treadway  Commission  (COSO) 
integrated  internal  eontrol  framework  to  inelude  eontrol  environment,  risk  assessment, 
eontrol  aetivities,  information  and  eommunieation,  and  monitoring  aetivities. 
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Control  environment  survey  items  relate  to  ethieal  standards,  trust,  management’s 
eonduct,  training  requirements  and  knowledge,  and  overall  work  environment.  Risk 
assessment  survey  items  relate  to  aeoountability,  suffieient  resourees,  and  factors 
that  may  affect  the  employee’s  work  environment  and  ability  to  complete  their  duties. 
Control  activities  survey  items  relate  to  current  policies  and  procedures,  the  process  for 
reporting,  the  knowledge  of  consequences,  supervision,  and  computer  systems’  security. 
Information  and  communication  survey  items  relate  to  the  interaction  between 
management  and  work  units,  knowledge  of  expected  behavior  and  performance,  channels 
of  communication,  and  the  process  of  sharing  information  to  reach  their  units’  objectives. 
Monitoring  activities  survey  items  relate  to  output  measurability  and  performance 
reviews,  reviews  of  policies  and  practices,  and  program  oversight. 

Finally,  there  were  three  open-ended  questions  at  the  end  of  the  survey.  The  open- 
ended  questions  asked  the  participant  to  list  or  describe  the  top  five  critical  success 
factors  needed  for  an  organization  to  achieve  its  mission  for  the  GPCP,  to  list  or  describe 
the  top  five  issues  that  could  hinder  the  success  of  the  GPCP,  and  to  explain  why  he  or 
she  disagreed  or  strongly  disagreed  with  any  of  the  survey  questions. 

C.  SURVEY  DEPLOYMENT 

The  survey  was  deployed  to  AOs  and  CHs  in  the  purchase  card  program  at  NPS. 
Each  participant  was  sent  an  e-mail  with  a  link  to  the  web-based  survey  on  LimeSurvey. 
The  survey  was  voluntary  and  anonymous.  No  personally  identifiable  information  (PII) 
was  collected.  All  participants  were  given  permission  to  complete  the  survey  at  their 
workstation  and  during  work  hours.  The  survey  was  available  for  three  weeks.  Once  the 
survey  was  closed,  the  researchers  collected  the  responses  from  LimeSurvey  to  conduct 
an  analysis  of  the  data.  The  population  consisted  of  56  potential  participants,  13  of  whom 
submitted  a  complete  survey;  therefore,  the  survey  participation  rate  was  23%. 

D,  PROCESS  USED  TO  ANALYZE  DATA 

Due  to  the  low  participation  rate,  the  data  was  analyzed  using  only  descriptive 

statistics.  The  collected  data  was  analyzed  using  IBM  SPSS  Statistics  Version  19.  The 

responses  were  coded  to  assist  with  the  analysis.  Descriptive  statistics  “involves 
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arranging,  summarizing,  and  presenting  a  set  of  data  in  such  a  way  that  useful 
information  is  produced.  Its  methods  make  use  of  graphical  techniques  and  numerical 
descriptive  measures  (such  as  averages)  to  summarize  and  present  the  data”  (Keller, 
2009,  p.  12).  The  survey  did  not  ask  knowledge  questions  because  the  research  study  was 
not  assessing  participants’  knowledge  of  internal  controls;  it  was  simply  identifying  their 
perceptions  of  compliance  to  internal  controls  within  the  NFS  GPCP.  The  data  gathered 
from  the  results  were  analyzed  in  several  different  ways  as  discussed  later;  however,  the 
basis  of  analysis  was  the  mean,  or  average,  response. 

Initially,  the  overall  frequency  of  the  demographics  questions  is  identified.  Then, 
the  mean  for  each  of  the  five  internal  control  components  are  calculated  and  presented. 
The  mean  is  the  average,  and  the  frequency  is  the  rate  of  occurrence.  In  addition,  the  five 
internal  control  components  are  analyzed  by  the  participants’  position  in  the  government, 
AO  or  CH,  which  are  used  to  identify  any  differences  in  perceptions  of  internal  controls 
between  AOs  and  CHs.  Additional  observations  based  other  analysis  are  discussed.  The 
frequency  of  “I  don’t  know”  responses  is  also  discussed.  Finally,  any  potential 
implications  of  the  survey  findings  on  internal  controls  may  have  on  auditability  are 
discussed. 

E.  SUMMARY 

This  chapter  provided  an  outline  of  the  methodology  used  to  conduct  this  research 
study.  The  method  used  to  develop  the  survey,  the  sources  used  to  develop  the  individual 
questions  used  in  the  survey  instrument,  and  the  deployment  of  the  survey  were 
discussed.  The  process  used  to  analyze  the  data  was  also  addressed.  The  next  chapter 
discusses  the  results  of  the  research,  provides  an  analysis  of  the  results,  identifies  any 
implications  of  the  research  results,  and  provides  recommendations  based  on  the  data 
analysis. 
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V.  RESULTS,  ANALYSIS,  IMPLICATIONS,  AND 
RECOMMENDATIONS 


A,  INTRODUCTION 

In  this  chapter,  the  results  of  the  online  survey  eolleeted  from  LimeSurvey  are 
presented,  which  include  survey  items  pertaining  to  demographics  and  the  five 
eomponents  of  internal  eontrol:  eontrol  environment,  risk  assessment,  eontrol  aetivities, 
information  and  eommunieation,  and  monitoring  aetivities.  The  overall  population’s 
mean  of  the  Likert-based  responses  in  addition  to  the  frequeney  of  the  demographies 
survey  items  are  identified.  The  mean  for  eaeh  of  the  five  internal  eontrol  eomponents  are 
also  ealeulated  and  presented.  The  mean  and  frequeney  of  responses  from  the  approving 
offieials  (AOs)  and  cardholders  (CHs)  are  eompared  and  analyzed  to  identify  any 
differenees  in  perceptions  of  internal  eontrols  between  AOs  and  CHs.  Additional  analysis 
based  on  the  results  is  discussed.  The  open-ended  questions  were  not  analyzed  as  part  of 
this  researeh  study.  Furthermore,  any  potential  implications  of  the  survey  findings  on 
internal  eontrols,  or  laek  thereof,  on  auditability  within  the  Government  Purehase  Card 
Program  (GPCP)  at  the  Naval  Postgraduate  Sehool  (NPS)  are  addressed.  Finally, 
reeommendations  based  on  the  data  analysis  are  presented. 

B,  ANALYSIS  OF  DEMOGRAPHIC  QUESTIONS 

1.  Survey  Response 

The  survey  was  deployed  on  Tuesday,  January  14,  2014  and  was  open  for  three 
weeks  until  it  elosed  on  Tuesday,  February  4,  2014.  During  the  time  that  the  survey  was 
available,  13  partieipants  responded.  The  web-based  survey  link  was  sent  to  56  people,  so 
the  response  rate  was  23%.  All  partieipants  were  federal  eivilian  employees,  and  out  of 
the  13  responses,  six  were  AOs  and  seven  were  CHs.  The  survey  eonsisted  of  Likert- 
based  survey  items  with  seven  options  ranging  from  “Strongly  Agree”  to  “Strongly 
Disagree.”  The  partieipants  also  had  the  option  to  ehoose  “I  don’t  know”  or  “I  prefer  not 
to  answer.”  Of  the  total  survey  items,  there  were  eight  demographies  survey  items, 
ineluding  employment  category  and  position,  whieh  are  discussed  next. 
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2,  Responses  by  Experience 

The  response  options  were  divided  into  six  categories  based  on  years  of 
experience  in  the  role  as  AO  or  CH.  The  options  were  0-1,  2-3,  4-5,  6-7,  8-9,  and  over 
10  years.  Figure  2  displays  the  responses.  Based  on  the  responses,  approximately  8%  of 
participants  indicated  that  they  had  less  than  one  year  of  experience,  while  38%  of  the 
participants  had  four  to  five  years  of  experience,  and  23%  had  over  10  years  of 
experience. 


■  0-1  years 

■  2-3  years 

■  4-5  years 

■  6-7  years 

■  over  10  \'ears 


Figure  2.  Number  of  Responses  by  Years  of  Experience  as  an  AO  or  CH 

3,  Responses  by  Number  of  Schools 

The  response  options  were  divided  into  four  categories  based  on  the  number 
of  schools  each  participant  was  responsible  for  in  the  GPCP.  The  options  were  1,  2,  3,  or 
4  schools.  Figure  3  displays  the  responses.  Out  of  the  four  possible  options,  participants 
chose  only  two  of  the  available  options.  Based  on  the  responses,  approximately  77%  of 
the  participants  were  responsible  for  one  school  in  the  GPCP,  while  the  remaining 
23%  were  responsible  for  four  schools  in  the  GPCP. 
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Figure  3.  Number  of  Responses  to  Number  of  Schools  Supported 


4,  Responses  by  Number  of  Departments 

The  response  options  were  divided  into  four  categories  based  on  how  many 
departments  each  participant  was  responsible  for  in  the  GPCP.  The  options  were  0-3, 
4-6,  7-10,  or  more  than  10  departments.  Figure  4  displays  the  responses.  The  data  shows 
that  54%  of  the  participants  were  responsible  for  0-3  departments,  and  only  15%  were 
responsible  for  more  than  10  departments.  The  remaining  31%  were  responsible  for 
4-10  departments;  one  for  4-6  departments  (8%)  and  three  for  7-10  departments  (23%). 
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Figure  4.  Number  of  Responses  to  Number  of  Departments  Supported 


5,  Responses  by  Number  of  People  AO  Oversees 

The  AOs  were  asked  how  many  people  they  oversee  in  the  GPCP.  The  options 
were  0-5,  6-10,  11-15,  16-20,  or  more  than  20  people.  Figure  5  displays  the  responses. 
Based  on  the  responses,  83%  of  the  AOs  oversaw  0-5  people  and  17%  oversaw 
6-10  people.  It  is  important  to  note  that  the  numbers  are  eonsistent  with  the  regulation 
that  an  AO  may  oversee  no  more  than  seven  CHs. 
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Number  of  People  AOs  Oversee 


Figure  5 .  Number  of  Responses  by  Number  of  People  AOs  Oversee 

6,  Responses  by  Number  of  People  CH  Supports 

The  CHs  were  asked  how  many  people  they  support  in  the  GPCP.  The  options 
were  0-5,  6-10,  11-15,  16-20,  or  more  than  20  people.  Figure  6  displays  the  responses. 
Based  on  the  responses,  29%  of  CHs  responded  that  they  supported  0-5  people  and 
71%  of  CHs  responded  that  they  supported  more  than  20  people.  The  number  of  people 
eaeh  CH  supported  may  be  related  to  the  size  of  the  school(s)  and  department(s)  they 
eaeh  supported. 


47 
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Figure  6.  Number  of  Responses  by  Number  of  People  CFIs  Support 


7.  Responses  by  Percentage  of  Time  Spent  on  Collateral  Duty 

The  partieipants  were  also  questioned  regarding  the  pereentage  of  their  working 
hours  that  were  spent  condueting  GPCP  collateral  duty  assignments.  The  options  were 
100%,  75%,  50%,  25%,  or  less  than  25%.  Figure  7  displays  the  responses.  Based  on  the 
responses,  approximately  46%  of  participants — five  AOs  and  one  CH — responded  that 
they  spent  less  than  25%  of  working  hours  conducting  GPCP  collateral  duties  and  38%  of 
participants,  all  of  whom  were  CFIs,  spent  more  than  75%  of  their  working  hours 
conducting  GPCP  collateral  duties.  Only  one  responded  that  100%  of  their  working  hours 
were  spent  conducting  GPCP  collateral  duty  assignments,  which  implies  that  this  was  not 
a  collateral  duty  for  this  one  person;  it  was  a  full-time  duty. 
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Figure  7.  Number  of  Responses  by  Collateral  Duty  as  Percentage 

of  Working  Flours 

In  this  section,  overall  frequency  data  for  the  demographics  was  presented.  The 
analysis  of  the  data  for  the  five  internal  control  components  is  presented  next. 

C.  ANALYSIS  OF  INTERNAL  CONTROL  QUESTIONS 

The  survey  consisted  of  69  survey  items  relating  to  Committee  of  Sponsoring 
Organization  of  the  Treadway  Commission’s  (COSO)  five  internal  control  components. 
The  mean  calculations  did  not  include  one  survey  item  from  the  risk  assessment 
component  that  only  pertained  to  AOs;  therefore,  68  survey  items  were  used  in  the 
analysis.  During  analysis  of  the  individual  survey  items  within  each  component,  “I  don’t 
know”  responses  were  coded  as  0  (zero  value).  The  “I  don’t  know”  responses  were  not 
included  in  the  mean  calculations.  They  were  converted  to  blanks  in  the  Excel 
spreadsheet  and  were  identified  as  missing  responses  in  SPSS.  The  open-ended  questions 
were  not  analyzed  as  part  of  this  research. 

Figure  8  displays  the  overall  mean  for  each  internal  control  component.  Based  on 
the  survey  results,  risk  assessment  scored  the  lowest  with  a  mean  of  3.2,  meaning  this 
component  had  more  “disagree,”  or  “neither  agree  nor  disagree,”  responses  to  the  survey 
items  pertaining  to  risk  assessment.  Control  activities  scored  the  highest  with  a  mean  of 
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Percentage  of  Working  Hours 
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3.78,  meaning  this  component  had  more  “agree,”  or  “neither  agree  nor  disagree” 
responses  to  the  survey  items  pertaining  to  control  activities.  Thus,  the  risk  assessment 
controls  were  perceived  to  be  the  weakest  of  the  five  internal  control  components, 
whereas  the  control  activities  were  perceived  to  be  the  strongest  internal  control 
component  within  the  GPCP  at  NPS. 


Control  Risk  Control  Information  &  Monitoring 

Emironment  Assessment  ActiWties  Communication  Actirities 

Internal  Control  Component 


Figure  8.  Average  Response  by  Internal  Control  Component 

1,  Control  Environment 

As  shown  in  Figure  8,  the  overall  mean  for  the  control  environment  component 
was  3.57,  second  highest  after  control  activities.  Comparing  the  two  groups.  Figure  9 
shows  a  mean  of  3.69  for  AOs  and  3.47  for  CHs. 
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Figure  9.  Average  Response  for  Control  Environment  Component 

2,  Risk  Assessment 

The  lowest  overall  mean  of  the  five  internal  eontrol  components  was  risk 
assessment,  with  a  mean  of  3.2  as  shown  in  Figure  8,  and  that  finding  is  corroborated  by 
the  data  in  Figure  10.  The  mean  responses  of  AOs  and  CHs  were  compared,  and  the  data 
indicates  that  CHs  disagree  with  more  components  of  risk  assessment  than  AOs.  The 
AOs’  mean  response  for  survey  items  pertaining  to  risk  assessment  was  3.56,  whereas  the 
CHs’  mean  response  was  2.94. 
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Figure  10.  Average  Response  for  Risk  Assessment  Component 


3,  Control  Activities 

The  highest  overall  mean  of  the  internal  eontrol  components  was  for  control 
activities,  with  a  mean  of  3.78  as  shown  in  Figure  8,  and  that  finding  is  supported  by  the 
data  in  Figure  11.  The  AOs’  mean  response  to  the  survey  items  pertaining  to  control 
activities  was  3.85  and  the  CHs’  was  3.7. 


Figure  1 1 .  Average  Response  for  Control  Activities  Component 
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4. 


Information  and  Communication 


As  shown  in  Figure  8,  the  internal  control  component  information  and 
communication  had  the  second  lowest  overall  mean  with  3.45.  Figure  12  shows  the 
comparison  of  the  AOs’  mean  response  within  this  component  of  3.53  and  the  CHs’ 
mean  of  3.36. 


Figure  12.  Average  Response  for  Information  and  Communication  Component 


5,  Monitoring  Activities 

The  monitoring  activities  component  had  an  overall  mean  of  3.5  as  shown  in 
Figure  8.  Figure  13  compares  the  AOs’  overall  mean  of  3.59  and  the  CHs’  of  3.45. 
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Figure  13.  Average  Response  for  Monitoring  Activities  Component 


Table  2  presents  the  number  of  survey  items  within  each  of  the  five  internal 
control  components  and  the  mean  response  from  AOs  and  CHs  for  each  component.  The 
“1  don’t  know”  responses  were  not  calculated  in  the  mean. 
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Internal  Control 
Component 

Number  of  Survey 
Items 

Mean  of 
Approving 
Officials 

Mean  of 
Cardholders 

Control  Environment 

17 

3.69 

3.47 

Risk  Assessment 

8 

3.56 

2.94 

Control  Activities 

14 

3.85 

3.70 

Information  and 
Communication 

16 

3.53 

3.36 

Monitoring  Activities 

14 

3.59 

3.45 

Total 

68 

Table  2.  Number  of  Survey  Items  and  Mean  Responses  From  AOs 
and  CHs  for  the  Five  Internal  Control  Components 


The  mean  was  used  to  analyze  the  data  for  eaeh  of  the  five  internal  eontrol 
eomponents  separately,  whieh  produeed  one  mean  per  internal  eontrol  eomponent,  as 
shown  in  Figure  8.  In  addition,  the  mean  of  the  responses  from  AOs  and  CHs,  in  relation 
to  eaeh  survey  item  within  eaeh  eomponent,  was  eompared  to  identify  any  differenees  in 
overall  responses  between  AOs  and  CHs. 

D.  ADDITIONAL  ANALYSIS 

From  additional  data  analysis,  survey  items  that  were  deemed  signifieant  or 
important  to  discuss  were  considered  noteworthy.  In  this  section,  the  frequency  and  type 
of  survey  items  to  which  participants  responded  “I  don’t  know”  are  identified  and 
discussed.  In  addition,  survey  items  are  addressed  by  individual  survey  item  as  well  as  by 
the  differences  in  means  between  AOs  and  CHs  based  on  newly  created  criteria,  which 
are  explained  within  each  section  of  analysis. 
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1,  Analysis  of  “I  Don’t  Know”  Responses 

This  section  provides  analysis  of  the  “I  don’t  know”  responses.  The  “I  don’t 
know”  responses  indicated  possible  uncertainty  regarding  the  specific  survey  item,  which 
can  have  important  implications.  During  analysis  of  the  individual  survey  items  within 
each  component,  “I  don’t  know”  responses  were  coded  as  0  (zero  value).  The  “I  don’t 
know”  responses  were  not  included  in  the  mean  calculations.  They  were  converted  to 
blanks  in  the  Excel  spreadsheet  and  were  identified  as  missing  responses  in  SPSS. 
Overall,  there  were  26  “I  don’t  know”  responses,  which  will  now  be  referred  to  as 
missing  responses. 

There  were  two  missing  responses  within  the  control  environment  component. 
Those  survey  items  related  to  the  discussion  of  performance  standards  and  personal 
conduct.  The  control  environment  component  had  the  least  uncertainty  among  the 
participants,  with  only  two  missing  responses.  Within  the  risk  assessment  component, 
there  were  four  missing  responses.  Those  survey  items  pertained  to  pressure  to  get  the  job 
done  and  staff  accountability.  An  analysis  of  the  control  activities  component  revealed 
that  there  were  also  four  missing  responses.  Those  survey  items  pertained  to  the  span  of 
control  for  the  oversight  of  the  GPCP,  appropriate  consequences  to  those  who  break  laws 
and  rules,  and  knowledge  of  measures  in  place  to  block  certain  vendors. 

The  information  and  communication  component  had  nine  missing  responses.  This 
component  had  the  most  uncertainty  among  the  participants.  These  survey  items 
addressed  knowledge  of  employee  protection  for  reporting  impropriety,  consequences  of 
illegal/improper  use  of  the  purchase  card,  and  information  systems’  provision  of  reports 
to  management  on  a  unit’s  performance  related  to  its  objectives.  One  possible  implication 
of  the  relatively  high  number  of  “I  don’t  know”  responses  is  that  important  information 
may  not  be  disseminated  and;  therefore,  the  employees  may  not  be  aware  of  existing 
regulations.  The  monitoring  activities  component  had  seven  missing  responses.  This 
component  had  the  second  highest  level  of  uncertainty  among  the  participants.  These 
survey  items  were  regarding  timely  follow-up  to  feedback  and  complaints,  policy  review 
to  ensure  compliance,  GPCP  monitoring  to  ensure  correct  span  of  control,  and  systems’ 

ability  to  prevent  or  detect  missing  or  incorrect  information.  The  overall  implications  of 
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possible  uncertainty  in  the  area  of  information  and  communication  are  addressed  later. 
The  next  section  provides  an  analysis  of  Agree  and  Disagree  categories  by  internal 
control  component. 

2.  Analysis  of  Agree  and  Disagree  Categories  by  Internal  Control 
Component 

This  section  discusses  the  additional  analysis  on  the  “agree  and  strongly  agree” 
and  the  “disagree  and  strongly  disagree”  responses,  based  on  newly  created  categories 
and  criteria.  To  determine  whether  responses  to  a  question  was  interesting  to  note  for 
individual  survey  items,  using  SPSS,  the  valid  percent  was  calculated  for  each  of  the  five 
response  options:  “strongly  agree,”  “agree,”  “neither  agree  nor  disagree,”  “disagree,”  and 
“strongly  disagree.”  Those  who  responded  “I  don’t  know”  were  not  included  in  the  valid 
percent  calculation.  The  valid  percent  calculation  was  based  on  only  the  actual  responses 
for  each  particular  survey  item. 

The  valid  percents  for  “strongly  agree”  and  “agree”  were  combined  to  form 
category  “Agree”,  and  the  valid  percents  for  “strongly  disagree”  and  “disagree”  were  also 
combined  to  form  category  “Disagree.”  The  total  percentages  for  category  Agree  and  for 
category  Disagree  were  then  separated  into  three  sub-categories:  (1)  greater  than  50%  but 
less  than  75%,  (2)  greater  than  75%  but  less  than  100%,  and  (3)  100%.  However,  only  the 
survey  items  in  which  100%  of  the  participants  agreed  or  more  than  50%  of  the 
participants  disagreed  were  further  analyzed.  The  response  for  “neither  agree  nor 
disagree”  was  not  included  in  these  particular  calculations. 

The  survey  items  that  fell  into  the  100%  agree  sub-category  and  into  the  greater 
than  50%  disagree  sub-category  are  identified  and  explained  in  each  internal  control 
component  section.  All  findings  were  practically  significant,  meaning  it  has  valuable 
implications  to  the  management  of  the  GPCP. 

a.  Control  Environment 

There  were  no  survey  items  that  fell  into  the  100%  agree  sub-category  in  the 

control  environment  component.  There  were,  however,  three  survey  items  that  fell  into 

the  greater  than  50%  disagree  sub-category.  More  than  50%  of  the  participants  responded 
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that  an  atmosphere  of  mutual  trust  and  open  eommunieation  between  management  and 
employees  had  not  been  established  within  the  organization.  Also,  more  than  50%  of  the 
partieipants  disagreed  on  whether  their  work  units  were  eross-trained  so  that  they  eould 
fill  in  for  eaeh  other  when  neeessary.  Furthermore,  more  than  50%  partieipants  responded 
that  personnel  turnover  has  impaeted  their  units’  abilities  to  effeetively  perform  its 
funetions. 

b.  Risk  Assessment 

The  one  risk  assessment  survey  item  that  100%  of  the  partieipants  agreed  was  that 
AOs  hold  their  staff  aeeountable;  however,  only  three  out  of  six  AOs  responded  to  this 
question.  The  missing  three  may  have  answered  “not  applieable”;  however,  that  is  not 
eonsistent  with  the  demographies  question  asking  AOs  to  identify  how  many  people  they 
oversaw.  There  were  no  survey  items  that  fell  into  the  greater  than  50%  disagree  sub- 
eategory  in  the  risk  assessment  eomponent. 

c.  Control  Activities 

Two  survey  items  within  eontrol  aetivities  fell  into  the  100%  agree  sub-eategory. 
One  hundred  pereent  of  partieipants  agreed  that  they  were  diseouraged  from  sharing  their 
eomputer  passwords  with  others.  In  addition,  100%  of  the  partieipants  agreed  that  their 
organization  effeetively  established  proeesses  so  that  no  single  person  in  the  organization 
buys,  reeeives,  and  eertifies  funds  within  the  purehase  eard  program.  There  were  no 
survey  items  that  fell  into  the  greater  than  50%  disagree  sub-eategory  within  the  eontrol 
aetivities  eomponent. 

d.  Information  and  Communication 

There  was  one  survey  item  that  fell  into  the  100%  agree  sub-eategory  in  the 
information  and  eommunieations  eomponent.  One  hundred  pereent  of  the  partieipants 
agreed  that  they  knew  where  to  report  employee  miseonduet.  There  was  no  survey  item 
that  fell  within  the  greater  than  50%  disagree  sub-eategory  within  this  internal  eontrol 
eomponent. 
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e.  Monitoring  Activities 

There  was  only  one  question  that  fell  into  the  100%  agree  sub-category  in  the 
monitoring  activities  component,  which  was  that  100%  of  participants  knew  what  action 
to  take  if  they  became  aware  of  unethical  or  fraudulent  activity.  Additionally,  more  than 
50%  of  participants  did  not  agree  that  internal  and/or  external  feedback  and  complaints 
were  followed  up  on  in  a  timely  and  effective  manner.  The  next  section  provides  an 
analysis  of  the  differences  in  means  between  AOs  and  CHs. 

3.  Analysis  of  Differences  in  Means 

This  section  discusses  additional  analysis  on  the  differences  in  means  between 
AOs  and  CHs,  based  on  a  newly  created  category.  From  the  data  analysis,  survey  items 
that  were  deemed  significant  or  important  to  discuss  were  considered  noteworthy.  During 
analysis  of  the  individual  survey  items  within  each  component,  “I  don’t  know”  responses 
were  coded  as  0  (zero  value).  The  “I  don’t  know”  responses  were  not  included  in  the 
mean  calculations.  To  determine  if  the  difference  in  means  by  survey  item  between  AOs 
and  CHs  was  noteworthy,  the  difference  in  means  between  AOs  and  CHs  was  calculated 
using  SPSS.  If  the  difference  was  found  to  be  greater  than  90%,  the  survey  item  was 
deemed  noteworthy.  However;  all  findings  were  practically  significant,  meaning  they 
have  valuable  implications  to  the  management  of  the  GPCP.  The  eight  survey  items  with 
a  noteworthy  difference  in  means  between  AOs  and  CHs  are  identified  below.  Of  the 
eight  noteworthy  differences,  seven  survey  items  indicated  that  CHs  responded 
significantly  lower  than  AOs,  whereas  only  one  question  indicated  that  AOs  responded 
significantly  lower  than  CHs. 

There  were  three  noteworthy  differences  in  the  risk  assessment  component  where 
CHs  responded  significantly  lower  than  AOs.  CHs  responded  that  they  felt  unreasonable 
pressure  to  get  the  job  done,  their  departments  did  not  identify  barriers  or  resolve  issues 
that  could  impact  achievement  objectives,  and  they  did  not  have  enough  time  in  the  day 
to  get  the  job  done,  including  their  collateral  duties.  The  third  survey  item  indicates  that 
CHs  perceive  that  they  do  not  have  enough  time  to  perform  their  GPCP  collateral  duties 
along  with  their  regular  job  duties. 
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There  were  also  three  noteworthy  differences  within  the  information  and 
communication  component  where  CHs  responded  significantly  lower  than  AOs.  CHs 
disagreed  that  their  information  systems  provided  management  with  timely  reports  on 
their  units’  performance  relative  to  objectives.  The  CHs  also  disagreed  that  the 
interaction  between  management  and  their  work  units  enabled  them  to  perform  their  jobs 
effectively.  Furthermore,  the  CHs  disagreed  that  management  was  aware  of  their  business 
units’  actual  performance. 

Finally,  there  were  two  noteworthy  differences  within  the  monitoring  activities 
component  where  AOs  responded  significantly  lower  than  CHs,  and  one  item  where  CHs 
responded  significantly  lower  than  AOs.  The  AOs  did  not  agree  that  computerized  data 
entry  systems  within  their  units  effectively  prevented  or  detected  missing  information  and 
CHs  disagreed  that,  in  their  absences,  a  qualified  CH  was  available  as  a  backup  if  needed. 
There  were  no  noteworthy  differences  in  means  between  AOs  and  CHs  in  the  control 
environment  or  the  control  activities  survey  items. 

This  section  presented  an  analysis  of  “I  don’t  know”  responses.  An  analysis  of  the 
Agree  and  Disagree  categories  by  the  five  internal  control  components  and  an  additional 
analysis  of  the  difference  in  means  between  AOs  and  CHs  were  presented.  The  next 
section  provides  implications  of  findings  related  to  the  research  questions. 

E,  IMPLICATIONS  OF  FINDINGS  RELATED  TO  RESEARCH 

QUESTIONS 

The  purpose  of  the  research  was  to  answer  the  questions  below  through  the 
development  and  deployment  of  the  online  survey  as  well  as  the  analysis  of  the  results. 

•  What  are  the  differences  in  perceptions  of  internal  controls  between  the 
approving  officials  and  cardholders  in  the  Government  Purchase  Card 
Program  at  the  Naval  Postgraduate  School? 

Based  on  the  analysis  of  the  results,  eight  significant  differences  in  perceptions 
between  AOs  and  CHs  were  identified  in  three  of  the  five  internal  control  components: 
risk  assessment,  information  and  communication,  and  monitoring  activities. 

Within  the  risk  assessment  component,  the  following  significant  differences 
between  AOs  and  CHs  were  identified: 
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1.  CHs  responded  that  they  did  not  have  enough  time  in  a  workday  to 
eomplete  their  duties,  including  collateral  duties,  whereas  AOs  did  not 
appear  to  have  this  perception. 

2.  CHs  felt  unreasonable  pressure  to  get  the  work  done,  whereas  AOs  did  not 
appear  to  have  this  perception. 

3.  CHs  responded  that  their  departments  did  not  identify  barriers  or  resolve 
issues  that  could  impact  achievement  of  department  objectives,  whereas 
AOs  did  not  appear  to  have  this  perception. 

Within  the  information  and  communication  component,  the  following  significant 
differences  between  AOs  and  CHs  were  identified: 

4.  CHs  responded  that  management  did  not  receive  timely  reports  on  their 
units’  performance  relative  to  their  objectives,  whereas  AOs  did  not 
appear  to  have  this  perception. 

5.  CHs  responded  that  interaction  between  management  and  their  units  did 
not  enable  them  to  do  their  jobs  effectively,  whereas  AOs  did  not  appear 
to  have  this  perception. 

6.  CHs  responded  that  management  was  not  informed  or  aware  of  their  units’ 
actual  performance,  which  differs  significantly  from  the  responses  from 
AOs. 

Within  the  monitoring  activities  component,  the  following  significant  differences 
between  AOs  and  CHs  were  identified: 

7.  AOs’  responded  that  their  units’  computerized  systems  were  not  able  to 
effectively  prevent  or  detect  missing  and  incorrect  information,  which 
differed  from  CHs  perception. 

8.  CHs  did  not  agree  that  there  was  a  qualified  CH  available  as  a  backup  to 
meet  their  end  users’  needs  in  their  absences.  AOs,  on  the  other  hand, 
strongly  agreed  that  there  was  a  qualified  AO  available  as  a  backup  in 
their  absences. 

Overall,  the  means  for  each  internal  control  component  for  AOs  were  consistently 
higher  than  for  CHs.  This  finding  implies  that  AOs  generally  perceive  the  strength  of  the 
GPCP’s  internal  controls  to  be  stronger  than  the  CHs  perceive  them. 

•  What  are  the  implications  to  auditability  from  the  differences  in 
perceptions  of  internal  control  between  approving  officials  and 
cardholders  within  the  Government  Purchase  Card  Program  at  the  Naval 
Postgraduate  School? 

Both  strong  and  weak  internal  controls  have  implications  on  auditability.  The 
analysis  identified  potential  implications  of  internal  controls,  or  lack  thereof,  on 
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auditability  within  the  GPCP  at  NPS.  An  implication  of  the  differences  in  perceptions  in 
the  risk  assessment  component  is  that  GPCP  participants  may  be  rushed  to  complete  the 
job  in  order  to  meet  their  organization’s  goals.  This  could  lead  to  making  mistakes  in  the 
process,  increasing  the  vulnerability  for  possible  fraud,  waste,  and  abuse,  and  hindering 
the  organization’s  auditability  (GAO,  2008).  An  implication  of  the  differences  in 
perceptions  in  the  information  and  communication  component  is  that  progress  and 
objectives  are  possibly  not  being  measured,  and  proper  oversight  may  not  be  present. 
CHs  and  management  may  not  be  communicating  effectively  to  achieve  the  best  results 
for  the  organization.  If  management  is  unaware  of  a  unit’s  performance,  it  may  hinder 
them  from  making  informed  decisions  for  the  organization. 

Another  implication  of  the  differences  in  perceptions  in  the  information  and 
communication  component  is  that  participants  appear  to  know  where  to  report  suspected 
wrong-doing  or  improprieties  and  appear  to  be  aware  of  the  potential  consequences. 
However,  the  results  indicate  that  majority  of  them  may  not  know  if  management  ensures 
appropriate  actions  after  the  initial  reporting.  If  management  does  not  take  proper  action 
against  wrong-doing  and  improprieties,  CHs  and  AOs  may  not  take  management  or  the 
potential  consequences  seriously.  An  implication  of  the  differences  in  perceptions  in  the 
monitoring  activities  component  is  from  the  difference  of  perceptions  regarding 
reliability  of  the  organization’s  computer  systems.  If  the  organization  cannot  rely  on  the 
unit’s  computerized  system,  the  employee  must  have  comprehensive  knowledge  of  the 
system  to  prevent  errors  themselves,  and  if  they  rely  on  the  computer  system  which  may 
be  unreliable,  it  may  hinder  the  organization  from  becoming  auditable.  Finally,  if 
qualified  people  are  not  available  to  act  as  backups,  the  organization  would  not  be  able  to 
support  its  end  users.  The  absence  of  effective  internal  controls  can  expose  the  purchase 
card  program  to  inefficiencies  and  vulnerabilities  to  fraud,  which  would  impact 
auditability  in  the  organization.  The  next  section  provides  recommendations  based  on  the 
data  analysis. 
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F.  RECOMMENDATIONS  BASED  ON  DATA  ANALYSIS 

The  recommendations  based  on  the  data  analysis  of  the  five  components  of 
internal  control  and  the  implications  of  differences  in  perceptions  between  AOs  and  CHs 
are  presented  below. 

1,  Strengthen  the  Organization’s  Control  Environment 

In  order  to  be  a  productive  organization,  management  needs  to  maintain  ethical 
values  and  cultivate  trust  with  their  employees.  Although  the  management  personnel  in 
the  GPCP  may  not  be  the  AOs,  who  are  direct  supervisors  of  the  CHs,  it  is  imperative  to 
act  with  integrity  and  strong  ethical  values  to  set  an  example  for  those  who  work  within 
the  GPCP.  Based  on  the  data  analysis,  there  may  be  a  lack  of  mutual  trust  and  open 
communication  between  management  and  employees.  Management  should  ensure  that 
their  communication  plan  and  organizational  goals  are  transparent  and  communicated 
throughout  the  organization.  In  addition,  the  reporting  relationships  should  be  clearly 
identified  so  employees  may  feel  comfortable  communicating  with  their  supervisor 
and  other  management  personnel.  This  may  increase  employees’  trust  and  open 
communication  with  management. 

Another  aspect  of  the  control  environment  that  should  be  addressed  is  the  formal 
codes  and  policies  that  communicate  ethical  behavior  and  standards.  A  weakness 
identified  by  the  data  analysis  is  that  employees  may  not  have  known  the  penalties  of 
unacceptable  behavior  or  if  prompt  action  is  taken  when  there  is  improper  use  of  the 
purchase  card.  The  codes  of  ethics  and  integrity  should  be  periodically  reviewed  and 
acknowledged  by  signature  from  all  employees.  In  addition,  management  should  clearly 
communicate  and  disseminate  information  regarding  processing  and  handling  of  an 
incident  with  the  purchase  card. 

2.  Enhance  Communication 

Information  and  communication  should  be  taken  seriously,  so  it  is  imperative  to 
clearly  communicate  the  organization’s  mission,  expectations,  and  strategies  to  all 
employees.  The  data  analysis  identified  several  areas  of  weaknesses  within  the 
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information  and  communication  component;  therefore,  several  recommendations  are 
made  to  enhance  communieation  within  the  GPCP.  A  message  regarding  the  GPCP’s 
organizational  structure  and  objectives  should  be  generated  out  to  AOs  and  CHs,  and  it 
should  be  clearly  stated  so  that  there  are  no  misunderstandings  or  miscommunications. 
To  increase  understanding  of  the  organization,  management  should  also  eneourage  AOs 
and  CHs  to  read  the  existing  policies  and  proeedures  regarding  the  GPCP,  if  they  have 
not  done  so  before.  In  addition,  management  should  review  ehanges  to  polieies  and 
proeedures  in  both  AOs’  and  CHs’  meetings  to  generate  a  clear,  unified  message. 

Furthermore,  CHs  responded  that  interaction  between  management  and  their  units 
did  not  enable  them  to  do  their  jobs  effeetively.  This  may  be  an  area  of  improvement  for 
management  to  continue  eommunicating  elear  objectives  and  maintain  flexibility  to 
enable  CHs  to  do  their  job  effectively.  If  a  CHs’  AO  is  preventing  them  from  doing  their 
job  effectively,  there  should  be  a  means  of  communieation  outside  of  a  direct  supervisor. 
If  an  alternate  line  of  communication  is  available,  that  information  should  be 
disseminated  to  all  employees. 

Finally,  the  purpose  of  information  and  communieation  is  to  distribute 
information  at  the  right  time  and  to  the  right  people  in  order  to  carry  out  roles  and 
responsibilities.  An  identified  potential  weakness  is  that  management  may  not  be 
informed  of  their  units’  performance.  Management  may  be  unable  to  make  the  most 
informed  deeision  if  they  are  unaware  of  their  employees’  units’  aetual  performanee  and 
do  not  receive  timely  reports.  In  order  to  strengthen  that  pereeived  weakness,  a  report  or 
spreadsheet  should  be  provided  to  management  with  weekly  or  monthly  progress  based 
on  objeetives  set  by  the  unit  or  the  GPCP.  It  is  imperative  that  management  reeeives 
operating  information  to  determine  the  organization’s  level  of  compliance  with  laws  and 
regulations.  Ensuring  that  the  units’  data  and  performanee  measures  are  valid  and  reliable 
is  crucial  to  making  informed  deeisions. 

3,  Realign  Government  Purchase  Card  Program  Structure 

The  GPCP  organizational  strueture  should  be  realigned  to  balanee  the  number  of 
departments  and  number  of  people  that  each  CH  supports.  The  data  analysis  indicated 
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that  38%  of  participants,  all  of  whom  were  CHs,  spent  75%  of  their  working  hours 
conducting  GPCP  collateral  duties.  In  addition,  CHs  responded  that  they  felt 
unreasonable  pressure  to  get  the  job  done,  and  they  did  not  have  enough  time  in  the  day 
to  perform  all  their  duties,  including  collateral  duties.  To  inerease  productivity,  the 
program  strueture  should  identify  the  CHs  who  may  be  overworked  and  spending  more 
than  half  their  working  day  on  GPCP  eollateral  duties,  and  reorganize  it  to  balanee  the 
purchasing  support.  The  organization  should  ensure  that  CHs  reeeive  clear  objectives  and 
have  a  reasonable  amount  of  time  to  eomplete  their  duties,  ineluding  collateral  duties. 
This  reeommendation  may  inerease  productivity  in  both  the  CH’s  primary  and  collateral 
duties. 

Furthermore,  another  reeommendation  for  realigning  the  GPCP  structure  is  to 
ensure  all  AOs  and  CHs  are  properly  trained  and  equipped  with  the  necessary  tools  and 
information  to  achieve  their  goals.  In  order  to  maintain  productivity  and  achieve  their 
units’  objeetives  in  the  absence  of  an  AO  or  CH,  information  should  be  available  to  the 
units’  end  users  regarding  points  of  contact  and  proper  proeedures  that  should  be 
followed  in  their  absenee.  Each  unit  may  not  have  more  than  one  CH;  therefore,  the 
organization  should  also  ensure  that  all  pertinent  information  is  available  to  both  AOs 
and  CHs  when  needed. 

G.  SUMMARY 

In  this  chapter,  the  results  of  the  online  survey  collected  from  LimeSurvey  were 
presented,  which  included  survey  items  pertaining  to  demographics  and  the  five 
eomponents  of  internal  control.  The  overall  population’s  mean  of  the  Likert-based 
responses  in  addition  to  the  frequency  of  the  demographics  survey  items  were  identified. 
The  mean  for  eaeh  of  the  five  internal  eontrol  components  were  also  ealeulated  and 
presented.  The  mean  and  frequency  of  responses  from  the  AOs  and  CHs  were  compared 
and  analyzed  to  identify  any  differences  in  perceptions  to  internal  controls  between  AO 
and  CH.  Additional  analysis  based  on  the  results  was  discussed.  Furthermore,  any 
potential  implieations  of  internal  eontrols,  or  laek  thereof,  on  auditability  within  the 
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Government  Purchase  Card  Program  (GPCP)  at  the  Naval  Postgraduate  School  (NPS) 
were  addressed.  Finally,  recommendations  based  on  the  data  analysis  were  presented. 
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VI.  SUMMARY,  CONCLUSIONS,  AND  AREAS 
FOR  FURTHER  RESEARCH 


A,  SUMMARY 

The  Department  of  Defense  (DOD)  and  the  Department  of  the  Navy  (DON) 
purchase  card  programs  process  hundreds  of  thousands  of  transactions  accounting  for 
billions  of  dollars  annually.  In  2013,  the  federal  government’s  300,900  cardholders  (CHs) 
spent  $16.5  billion  on  18.9  million  transactions  (GSA,  n.d.-c).  In  FY20I2,  the  Naval 
Postgraduate  School  (NPS)  Government  Purchase  Card  Program  (GPCP)  was  responsible 
for  making  approximately  21,000  transactions  totaling  approximately  $24.2  million  (M. 
Morales,  personal  communication,  July  24,  2013).  Approving  Officials  (AOs)  and  CHs 
play  an  important  role  in  the  success  of  the  GPCP.  Additionally,  in  order  for  the  GPCP  to 
be  successful,  there  must  be  sufficient  corporate  governance,  specifically  effective 
internal  controls  and  auditability.  The  purpose  of  this  research  was  to  determine  whether 
there  were  differences  in  perceptions  between  AOs  and  CHs  regarding  internal  controls 
within  the  GPCP  at  NPS. 

B.  CONCLUSIONS 

Although  there  were  slight  differences  in  the  survey  item  means  between  AOs  and 
CHs,  there  is  still  practical  significance  to  all  of  the  findings.  The  AOs  consistently 
responded  higher  than  the  CHs  with  regard  to  the  five  internal  control  components.  This 
section  briefly  provides  conclusions  as  they  relate  to  the  research  questions. 

•  What  are  the  differences  in  perceptions  of  internal  controls  between  the 
approving  officials  and  cardholders  in  the  Government  Purchase  Card 
Program  at  the  Naval  Postgraduate  School? 

There  were  slight  differences  of  perceptions  of  internal  control  between  AOs  and 
CHs  within  each  of  the  five  internal  control  components.  However,  there  were  eight 
significant  differences  in  perceptions  of  internal  controls  between  AOs  and  CHs.  They 
were  identified  in  three  of  the  five  internal  control  components:  risk  assessment. 
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information  and  communication,  and  monitoring  activities.  The  researeh  findings 
revealed  that  AOs  consistently  responded  more  positively  to  internal  controls  in  the  five 
internal  eontrol  components  than  CHs,  implying  that  AOs  perceive  the  strength  of  the 
internal  controls  to  be  stronger  than  the  CHs  perceive  them  to  be  within  the  NFS  GPCP. 

•  What  are  the  implications  to  auditability  from  the  differenees  in 
pereeptions  of  internal  control  between  approving  officials  and 
cardholders  within  the  Government  Purchase  Card  Program  at  the  Naval 
Postgraduate  School? 

Both  strong  and  weak  internal  eontrols  have  implieations  on  auditability.  There 
were  survey  items  to  whieh  both  AOs  and  CHs  responded  strongly  agree,  which  included 
sueh  things  as  password  protection,  separation  of  duties,  and  adequate  fraud  education. 
However,  the  absence  of  effective  internal  eontrols  can  expose  the  purehase  card  program 
to  inefficiencies  and  vulnerabilities  to  fraud,  which  would  impact  auditability  in  the 
organization.  Weaknesses  mentioned  in  the  implieations  of  findings  could  lead  to 
employee’s  making  mistakes  somewhere  along  the  proeess,  ereating  possible  fraud, 
waste,  and  abuse,  and  further  hindering  the  organization’s  auditability.  Any  differenees  in 
perceptions  between  AOs  and  CHs  ean  have  an  impact  on  auditability  within  the  GPCP. 
The  following  seetion  suggests  areas  for  further  researeh. 

C.  AREAS  FOR  FURTHER  RESEARCH 

The  following  areas  for  further  researeh  are  suggested: 

One  area  for  further  research  is  to  expand  the  survey  to  other  DON  organizations 
to  analyze  the  differences  in  perceptions  of  internal  controls  within  the  organizations’ 
purchase  card  program.  The  expansion  of  the  survey  population  would  provide  more  data 
and  potentially  identify  similar  pereeived  trends  within  each  organization’s  purchase  eard 
program.  In  addition,  this  research  would  potentially  provide  insight  into  each 
organization’s  internal  eontrol  system  and  identify  the  strongest  and  weakest  components 
of  internal  control. 
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Another  area  for  further  researeh  would  be  to  expand  the  potential  survey 
partieipants  at  NPS  to  inelude  purehasing  agents  within  the  contraeting  office.  This 
addition  would  increase  the  number  of  potential  participants  and  provide  additional 
information  from  those  who  purchase  full-time  and  have  warrants  for  purchases  greater 
than  $150,000.  This  line  of  research  would  allow  for  a  more  diverse  analysis  between  the 
perceptions  of  AOs,  CHs,  and  purchasing  agents. 
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APPENDIX  A.  INDUSTRY  P-CARD  PROCESS 
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Figure  14.  Industry  P-Card  Process  (from  NAPCP,  2013b) 
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APPENDIX  B.  COSO’S  17  FUNDAMENTAL  PRINCIPLES 


Control  Einiroiimeiit 

(1)  Demonstrates  comnutment  to 
mtegnty  and  ethical  values 

(2)  Exercises  oversight  responsibility 

(3)  Estabhshes  structure,  authonty', 
and  responsibihty' 

(4)  Demonstrates  commitment  to 
competence 

(5)  Enforces  accoimtabihty _ 


Risk  Assessment 

(6)  Sets  specific  smtable  objectives 

(7)  Identifies  and  analv-zes  nsk 

(8)  Assesses  fi^ud  nsk 

(9)  Identifies  and  anaty’zes  significant 
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Monitoring  Actiiities 

(16)  Conducts  ongomg  and.' or  separate 
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(17)  Evaluates  and  communicates 
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Control  Actinties 

(10)  Selects  and  develops  control 
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Inforination  and  Communication 
(13)  Uses  relevant  mfonnation 
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control  over  teclmolog^' 

(12)  Deploys  through  policies  and 
procedures 


(14)  Conmiumcates  mtemally 

(15)  Conmiumcates  externally 


Figure  15.  COSO’s  17  Fundamental  Prineiples  (after  COSO,  2013;  Tan,  2013) 
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